AZ-104 Practice Exam 4

57 questions with the correct answer and an explanation for each. Topic: AZ-104. Free, no account needed.

These questions are written from Microsoft’s AZ-104 study guide and the Microsoft Learn modules and Azure documentation it points to. They are not real exam questions — those are confidential, and any site offering them is putting your certification at risk.

Take this test interactively

1. An administrator must deploy storage for a high-performance enterprise application that requires support for both Server Message Block (SMB) and NFS file shares, and the data must remain accessible if one availability zone fails. Later, the team asks to convert the account to a Standard account to reduce cost. Which choice correctly describes the deployment and the later request?

  1. Use a Premium block blobs account with ZRS; the account can be converted to Standard in place.
  2. Use a Premium file shares account with ZRS; a new Standard account must be created and the data copied to it.
  3. Use a Premium page blobs account with ZRS; a new Standard account must be created and the data copied to it.
  4. Use a Premium file shares account with GZRS; the account can be converted to Standard in place.

Answer: B — Use a Premium file shares account with ZRS; a new Standard account must be created and the data copied to it.

Premium file shares is recommended when both SMB and NFS file shares are required and supports LRS and ZRS, so ZRS meets the zone requirement. Standard and Premium accounts can't be converted, so a new Standard account must be created and the data copied to it. Premium block blobs supports only Blob Storage, Premium page blobs supports LRS only, and no option that claims an in-place conversion is valid.

2. An administrator must assign a role with Azure CLI at the scope of a virtual network named MyVirtualNetwork12345 in the resource group MyVirtualNetworkResourceGroup. Which scope string is correct?

  1. /subscriptions/{subscriptionId}/resourceGroups/MyVirtualNetworkResourceGroup/providers/Microsoft.Network/virtualNetworks/MyVirtualNetwork12345
  2. /subscriptions/{subscriptionId}/resourceGroups/MyVirtualNetworkResourceGroup/virtualNetworks/MyVirtualNetwork12345
  3. /providers/Microsoft.Network/virtualNetworks/MyVirtualNetwork12345
  4. /providers/Microsoft.Management/managementGroups/MyVirtualNetworkResourceGroup/virtualNetworks/MyVirtualNetwork12345

Answer: A — /subscriptions/{subscriptionId}/resourceGroups/MyVirtualNetworkResourceGroup/providers/Microsoft.Network/virtualNetworks/MyVirtualNetwork12345

A resource scope has the subscription, the resource group, then /providers/{providerName}/{resourceType}/{resourceName}. The other options omit the subscription or provider segments or mix in the management group format.

3. Older media files must stay immediately readable with millisecond latency, are rarely accessed, and will remain stored for at least 90 days. The company wants the lowest storage cost that still meets these requirements. Which access tier should be used?

  1. Hot
  2. Cool
  3. Cold
  4. Archive

Answer: C — Cold

Cold suits data kept at least 90 days, has lower storage cost than Cool and still offers millisecond latency. Archive is offline with hours of retrieval latency, and Cool costs more to store than Cold.

4. A team needs a budget to cover only first-party Azure consumption charges, excluding reserved instance and other purchase charges that are now included in budget evaluations. Which filters should be added to the budget?

  1. Publisher Type: Azure and Charge Type: Usage
  2. Publisher Type: Marketplace and Charge Type: Purchase
  3. Charge Type: Amortized and Publisher Type: Azure
  4. Publisher Type: Azure and Charge Type: Purchase

Answer: A — Publisher Type: Azure and Charge Type: Usage

Filtering on Publisher Type Azure and Charge Type Usage limits evaluation to first-party Azure consumption. Purchase or Marketplace filters would include or select the wrong charges, and budgets don't use amortized costs.

5. An administrator configures autoscaling for a scale set and wants the autoscale engine to avoid reacting to short CPU spikes by letting the metric stabilize before evaluating it. Which setting should be adjusted?

  1. Default instance count
  2. Instance limit
  3. Query duration
  4. Scale-in policy

Answer: C — Query duration

Query duration is the time the autoscale engine looks back for the metric usage average, allowing the metric to stabilize. The scale-in policy only determines the order VMs are selected for deletion in manual mode, and instance limits set min/max counts.

6. An administrator is designing an Azure File Sync deployment for several offices. Each office has its own Windows Server that must sync the same Azure file share. Which design is valid?

  1. One sync group with the Azure file share as its cloud endpoint and a server endpoint on a non-system NTFS volume on each server
  2. One sync group with two cloud endpoints, one per region, and a server endpoint on each server's system volume
  3. One sync group with the Azure file share as its cloud endpoint and a server endpoint on each server's system volume
  4. One sync group with the Azure file share as its cloud endpoint and server endpoints on ReFS-formatted volumes

Answer: A — One sync group with the Azure file share as its cloud endpoint and a server endpoint on a non-system NTFS volume on each server

A sync group has exactly one cloud endpoint and up to 50 server endpoints, which must be NTFS paths not on the system volume. Multiple cloud endpoints, system volumes, and non-NTFS (ReFS) volumes are not allowed.

7. An organization wants to share a standardized template with other teams. Those users must be able to deploy it but not change it, and access must be managed centrally. Which approach should the administrator use?

  1. Export the template from the resource group and distribute the JSON file
  2. Add a deploy button to a GitHub repository
  3. Store the template as a template spec and grant users read access by using role-based access control
  4. Use a Microsoft-provided Blueprint that contains the template

Answer: C — Store the template as a template spec and grant users read access by using role-based access control

A template spec stores the template as a resource type, and users with read access to it can deploy it but not change it. Distributing a JSON file or a GitHub button doesn't give access control over the shared template.

8. An administrator is designing access for several Azure Backup vaults (Backup vaults). Which two statements about the managed identities supported by a Backup vault are correct? (Choose two.)

  1. A system-assigned managed identity is created automatically when the vault is provisioned and is tied to the vault's lifecycle.
  2. A user-assigned managed identity is an independent Azure resource that can be assigned to more than one Backup vault.
  3. The system-assigned managed identity is mandatory and cannot be disabled.
  4. A Backup vault can have only one user-assigned managed identity associated with it.
  5. Azure Backup uses the vault's managed identity to access Azure Key Vault for encryption keys.

Answer: A,B — A system-assigned managed identity is created automatically when the vault is provisioned and is tied to the vault's lifecycle. / A user-assigned managed identity is an independent Azure resource that can be assigned to more than one Backup vault.

The system-assigned identity is created with the vault and shares its lifecycle, while a user-assigned identity is a standalone resource that can be assigned to one or more vaults. The system-assigned identity can be disabled, multiple user-assigned identities can be associated with one vault, and Key Vault access uses the Backup Management Service app rather than the vault's managed identity.

9. A company has cloud-only user identities and Microsoft Entra-joined Windows clients that have no network connectivity to any domain controller. The users need identity-based SMB access to Azure file shares. Which identity source should the administrator enable on the storage account?

  1. On-premises Active Directory Domain Services
  2. Microsoft Entra Domain Services
  3. Microsoft Entra Kerberos
  4. The storage account access key through Shared Key authorization

Answer: C — Microsoft Entra Kerberos

Microsoft Entra Kerberos supports cloud-only identities and doesn't require clients to have domain-controller connectivity. AD DS requires clients to reach the domain controllers, and Microsoft Entra Domain Services requires clients to be joined to the managed domain with connectivity to its domain controllers.

10. An administrator deploys Active Directory Domain Services on an Azure virtual machine. Which configuration must be applied to the storage that holds the AD DS database, logs and sysvol folder?

  1. Store them on drive C with Host Cache Preference set to ReadWrite
  2. Store them on additional data disks with Host Cache Preference set to ReadOnly
  3. Store them on additional data disks with Host Cache Preference set to None
  4. Store them on the temporary disk with Host Cache Preference set to None

Answer: C — Store them on additional data disks with Host Cache Preference set to None

AD DS storage should be on extra data disks, not drive C, and their Host Cache Preference must be None. ReadOnly or ReadWrite caching is not what is stated.

11. A company assigns a built-in policy that denies resource creation outside approved regions. An engineer who holds the Owner role on a resource group tries to deploy a virtual machine in a region that is not on the allowed list. What is the result?

  1. The deployment succeeds because Owner permissions override policy evaluation.
  2. The deployment is blocked because Azure Policy blocks the create even when the user has permission to perform it.
  3. The deployment succeeds, but the VM is flagged non-compliant and must be remediated manually.
  4. The deployment is blocked only if the engineer is not assigned the Resource Policy Contributor role.

Answer: B — The deployment is blocked because Azure Policy blocks the create even when the user has permission to perform it.

Azure Policy evaluates resource state regardless of who made the change or who has permission, so a non-compliant create is blocked even for an Owner. RBAC permissions do not override a deny effect.

12. An administrator needs a public IP address for a web workload that must keep running if one availability zone in the region fails. The address must be created now, in a region with three live availability zones, and must not need to be changed later. Which option meets the requirement?

  1. Create a Standard SKU public IP that is zone-redundant
  2. Create a Standard SKU public IP that is zonal in zone 1
  3. Create a Basic SKU public IP and later change its zone to 1, 2, 3
  4. Create a Basic SKU public IP with static IPv4 allocation
  5. Create a Standard v2 SKU public IP

Answer: A — Create a Standard SKU public IP that is zone-redundant

A zone-redundant IP is created in multiple zones and can survive any single zone failure, and Standard IPs can be zone-redundant. A zonal IP shares fate with its zone, Basic IPs are non-zonal and a public IP can't change its availability zone after creation, and Standard v2 IPs can only be used with the Standard v2 NAT gateway, not with any other product, so they can't serve a web workload.

13. A developer hosts a website in Azure App Service Web Apps and must ensure only users with accounts in the company's directory can access it, with different authentication settings for a staging deployment slot. Where does the administrator configure Microsoft Entra authentication?

  1. In the Authentication/Authorization blade of the web app in the Azure portal
  2. In a Group Policy Object linked to the web app
  3. In Microsoft Entra Connect Health
  4. In the Application Proxy connector settings on-premises

Answer: A — In the Authentication/Authorization blade of the web app in the Azure portal

Microsoft Entra authentication for Web Apps is enabled from the Authentication/Authorization blade, designating the tenant, and settings can differ per deployment slot. GPOs are not available in Entra ID.

14. An administrator must collect Syslog events from a Linux VM into Log Analytics. They create a data collection rule and need to deliver the data through a data collection endpoint. Which requirement applies when creating the endpoint?

  1. It must be created in the same subscription, resource group, and region as the VM
  2. It must be created in any region, because endpoints are global
  3. It must be created in the Log Analytics workspace's resource group only
  4. It must be created in the Log Analytics workspace's region, regardless of the VM's region

Answer: A — It must be created in the same subscription, resource group, and region as the VM

The steps specify selecting the same Subscription, Resource group, and Region that the VM uses when creating the data collection endpoint.

15. An administrator is planning a subnet with the range 192.168.1.0/24 for several VMs. The administrator will assign static addresses by hand and wants to know which addresses in the subnet cannot be assigned to resources. Which set of addresses is reserved by Azure in this subnet?

  1. 192.168.1.0, 192.168.1.1, 192.168.1.254 and 192.168.1.255
  2. 192.168.1.0, 192.168.1.1, 192.168.1.2, 192.168.1.3 and 192.168.1.255
  3. 192.168.1.0, 192.168.1.1, 192.168.1.2 and 192.168.1.255
  4. 192.168.1.1, 192.168.1.2, 192.168.1.3, 192.168.1.4 and 192.168.1.255

Answer: B — 192.168.1.0, 192.168.1.1, 192.168.1.2, 192.168.1.3 and 192.168.1.255

Azure reserves five addresses per subnet: the first four (network address, default gateway, two Azure DNS addresses) and the last (broadcast). Option C reserves only four, which is not what Azure does.

16. A team plans to scale a container app on concurrent TCP connections and to authenticate an Azure Queue scaler without storing secrets in the app. Which two of these configurations cannot be completed in the Azure portal? (Choose two.)

  1. Creating a TCP scale rule
  2. Authenticating a scale rule with managed identity
  3. Creating an HTTP scale rule with a concurrent requests value
  4. Creating a custom scale rule with secrets-based authentication
  5. Setting the minimum and maximum replica range

Answer: A,B — Creating a TCP scale rule / Authenticating a scale rule with managed identity

The portal does not support TCP scale rules, and managed identity authentication for scale rules requires the Azure CLI or Azure Resource Manager. HTTP rules, custom rules with secrets and the replica range are all configurable in the portal.

17. A company's policy states that Contoso users must not be able to send new guest invitations to users at fabrikam.com, but guests from Fabrikam who were already invited must keep working. Cross-tenant access settings already allow B2B collaboration with Fabrikam. Which configuration meets the requirement?

  1. Add fabrikam.com to the blocked domains in external collaboration settings.
  2. Block inbound B2B collaboration for Fabrikam in cross-tenant access settings.
  3. Turn off the email one-time passcode feature.
  4. Limit invitations to certain roles in external collaboration settings.

Answer: A — Add fabrikam.com to the blocked domains in external collaboration settings.

Blocking the domain in external collaboration settings stops new invitations while existing guests can continue using B2B collaboration. Cross-tenant access settings govern authentication rather than who may send invitations.

18. During a regional outage, an administrator fails over an Azure VM with Site Recovery. The business accepts a longer failover time but requires the least possible data loss, so every piece of data already sent to Site Recovery must be included. Which recovery point option should be selected?

  1. Latest processed
  2. Latest
  3. Latest app-consistent
  4. Custom

Answer: B — Latest

Latest processes all data sent to Site Recovery before failing over, giving the lowest RPO. Latest processed skips that processing for a low RTO, so it can lose more recent data.

19. A single-page web app has a public home page that anonymous users must be able to load. The app must let users choose among multiple sign-in providers, and the application code will handle authorization of unauthenticated traffic. Which App Service authentication setting should the administrator choose?

  1. Allow only authenticated requests, redirecting to /.auth/login/<provider>
  2. Allow Anonymous requests (no action), deferring authorization to application code
  3. Enable failed request tracing for the EasyAuthModule
  4. Enable HTTPS Only so that unauthenticated HTTP traffic is redirected

Answer: B — Allow Anonymous requests (no action), deferring authorization to application code

Allow Anonymous requests defers authorization to app code, passes identity in headers, and lets you present multiple sign-in providers while keeping a public home page. Allow only authenticated requests restricts all calls, which is undesirable for a public home page.

20. An administrator creates a scale set that must run VMs with different sizes and images in the same scale set. Later, the administrator wants to switch the scale set to run only identical instances from one image. Which two statements are correct?

  1. Flexible orchestration mode allows VMs to use different images, sizes or configurations in the same scale set
  2. Uniform orchestration mode creates all instances from the same base OS image and configuration
  3. The orchestration mode can be switched at any time from the scale set's Scaling blade
  4. Uniform orchestration mode is the portal default for new deployments
  5. Flexible orchestration mode requires all VM instances to use the same size

Answer: A,B — Flexible orchestration mode allows VMs to use different images, sizes or configurations in the same scale set / Uniform orchestration mode creates all instances from the same base OS image and configuration

Flexible mode permits different images, sizes or configurations, while Uniform creates all instances from the same image and configuration. The mode must be chosen at creation, and Flexible (not Uniform) is the default.

21. A developer wants to understand whether slow responses in an App Service app are caused by an external service it calls, and also wants to record business events such as the number of items sold. Which TWO Application Insights capabilities address these needs? (Choose two.)

  1. Dependency rates, response times, and failure rates
  2. Custom events and metrics
  3. Performance counters for CPU and memory
  4. Host diagnostics from Docker or Azure
  5. Page views and load performance

Answer: A,B — Dependency rates, response times, and failure rates / Custom events and metrics

Dependency tracking discovers whether external services are degrading app performance, and custom events and metrics track business events such as items sold. Performance counters, host diagnostics and page views cover server resources, container/host diagnostics and browser load, not these needs.

22. A subscription contains many alert rules, and some alerts come from sources that don't let you pick action groups, such as Azure Backup. An administrator needs to stop all alert notifications in the subscription every night and weekend, except for resources in one production resource group. The alert rules must keep firing and stay visible in the portal. Which solution meets the requirements?

  1. Disable each alert rule at the start of the window and re-enable it afterward
  2. An alert processing rule with the Suppression action, scoped to the subscription, a Resource group filter set to Does not equal the production group, and a recurring schedule
  3. An alert processing rule with the Apply action groups action, scoped to the production resource group
  4. An alert processing rule created in a second subscription that targets the first subscription

Answer: B — An alert processing rule with the Suppression action, scoped to the subscription, a Resource group filter set to Does not equal the production group, and a recurring schedule

Suppression removes the action groups from fired alerts while the alerts stay visible. A Does not equal Resource group filter excludes the production group, and a recurring schedule covers nights and weekends. Disabling alert rules stops alerts from firing and can't cover alerts that no rule generates, such as Azure Backup alerts.

23. A private endpoint to a storage account is showing a status of Disconnected after the storage account owner deleted the private-endpoint connection. What should the administrator who owns the private endpoint do?

  1. Wait for the connection to return to Approved automatically
  2. Delete the private endpoint, because it is only informative at this point
  3. Edit the connection status to Approved from the private endpoint blade
  4. Change the private endpoint's connection approval method to automatic

Answer: B — Delete the private endpoint, because it is only informative at this point

A Disconnected state means the owner removed the connection, and the private endpoint becomes informative and should be deleted for cleanup. The connection status is read-only and cannot be edited.

24. A web app in the Standard tier must be backed up on a schedule every 4 hours. The backup files must also be downloadable as blobs and kept for 30 days. Which approach meets these requirements?

  1. Use automatic backups and change their frequency to every 4 hours
  2. Configure custom backups to a storage account and set a schedule
  3. Use automatic backups and download them from the Backups page
  4. Use automatic backups with a _backup.filter file to limit their size

Answer: B — Configure custom backups to a storage account and set a schedule

Custom backups have a configurable frequency (minimum every 2 hours), 0-30 days or indefinite retention, and are downloadable as Azure Storage blobs. Automatic backups are hourly, not configurable and not downloadable.

25. A storage account has blob soft delete enabled with a 14-day retention period. A lifecycle management rule deletes blobs 60 days after creation. The finance team asks when a blob removed by this rule stops incurring storage charges.

  1. Immediately, because lifecycle delete operations are free and bypass soft delete
  2. After the next 24-hour policy evaluation
  3. Only when an administrator calls Undelete Blob
  4. After the 14-day soft delete retention period elapses

Answer: D — After the 14-day soft delete retention period elapses

A lifecycle delete puts the object into the soft-deleted state, where it remains recoverable and billed at the active rate until retention ends. Delete operations being free applies to the operation cost, not the retained data.

26. A support engineer is a Microsoft Entra Global Administrator and has no Azure role assignments. They need to restart a virtual machine in a subscription that is associated with the tenant. What is the situation?

  1. They can restart it, because Global Administrators automatically have access to all resources in the tenant's subscriptions
  2. They can restart it, because the subscription is associated with their tenant
  3. They can't restart it until an Azure role granting that operation is assigned to them at an applicable scope
  4. They can't restart it until they are given a Microsoft Entra role for managing applications

Answer: C — They can't restart it until an Azure role granting that operation is assigned to them at an applicable scope

Directory administration and Azure resource access are separate role systems, so a Global Administrator needs an Azure role assignment. Entra roles don't manage Azure resource access.

27. An administrator is moving a resource to a different subscription and receives an error that the subscription isn't registered for a resource type. The resource type hasn't previously been used in the destination subscription. What should the administrator do?

  1. Register the resource provider, for example with az provider register --namespace, in the destination subscription.
  2. Register the resource provider in the source subscription.
  3. Raise the quota for the resource type in the source subscription.
  4. Create a support request with the Subscription Management issue type to enable the source subscription.

Answer: A — Register the resource provider, for example with az provider register --namespace, in the destination subscription.

The destination subscription must be registered for the resource provider of the resource being moved, which is done with az provider register or Register-AzResourceProvider. Registering in the source doesn't fix the destination error.

28. A company deploys Azure Bastion in a virtual network. Administrators must connect to VMs by using the RDP client already installed on their laptops, and they also need to send users a link so those users can reach a VM without signing in to the Azure portal. The company wants to pay for the lowest SKU that meets both needs. Which SKU should be deployed?

  1. Developer
  2. Basic
  3. Standard
  4. Premium

Answer: C — Standard

Native client connections and shareable links are both available starting with the Standard SKU. Basic only supports browser-based connections, and Premium adds session recording and private-only deployment that are not required.

29. A governance team wants to tag one storage account with many metadata attributes and finds they are approaching the tag limit for the resource. What is the documented way to attach more information than the maximum number of tag name-value pairs allows?

  1. Put the extra values into a JSON string used as the value of a single tag name.
  2. Apply the extra tags at the management group, where they are inherited by the resource.
  3. Request a higher tag limit through the Azure portal for the storage account.
  4. Use tag names longer than 128 characters to carry multiple values.

Answer: A — Put the extra values into a JSON string used as the value of a single tag name.

Each resource is limited to 50 tag name-value pairs, so extra values can be packed into a JSON string as the value of one tag name. Tags cannot be applied to management groups and storage tag names are limited to 128 characters.

30. A company must encrypt data in a storage account with keys it creates, rotates and audits itself. It also requires FIPS 140-2 Level 3 validated key protection, and the keys must be usable by an account in a different subscription than the key store. Which design meets the requirements?

  1. Platform-managed keys, with the key store in a different region
  2. Customer-managed keys in an Azure Key Vault Managed HSM in the same region as the storage account
  3. Customer-managed keys in a Managed HSM located in a different region from the storage account
  4. Infrastructure encryption only, using the default Azure-managed keys

Answer: B — Customer-managed keys in an Azure Key Vault Managed HSM in the same region as the storage account

Customer-managed keys allow creating, rotating and auditing keys, Managed HSM provides FIPS 140-2 Level 3, and the account and key vault must be in the same region but may be in different subscriptions. A cross-region vault is not allowed, and platform-managed keys give the customer no control.

31. A team's base container image receives frequent security patches. They want every dependent application image rebuilt in Azure automatically when the base image changes, without maintaining their own build servers. Which registry capability meets this requirement?

  1. Azure Container Registry tasks configured with a base image update trigger
  2. Microsoft Defender for Cloud integration with the registry
  3. Geo-replication of the registry
  4. Webhook integration on the registry

Answer: A — Azure Container Registry tasks configured with a base image update trigger

Azure Container Registry tasks can rebuild images automatically when base images are updated and offload docker build operations to Azure. Defender for Cloud only scans images pushed to the registry, and geo-replication only distributes images across geographies.

32. A connection troubleshoot test from one VM to another fails. The result shows the fault type NetworkSecurityRule. Which cause does this fault type indicate?

  1. A firewall outside of Azure blocked the connection
  2. An incorrect user route exists in a routing table
  3. The destination IP address could not be resolved
  4. An NSG blocked the connection

Answer: D — An NSG blocked the connection

NetworkSecurityRule means an NSG blocked the connection. GuestFirewall is the fault for a firewall outside of Azure, UserDefinedRoute for a bad user route, and DNSResolution for an unresolved destination.

33. An administrator must create a new alert rule from the Azure portal. Which two permissions must the administrator have? (Choose two.)

  1. Read permission on the target resource of the alert rule
  2. Write permission on the target resource of the alert rule
  3. Write permission on the resource group in which the alert rule is created
  4. Write permission on the subscription of the target resource
  5. Delete permission on the resource group in which the alert rule is created

Answer: A,C — Read permission on the target resource of the alert rule / Write permission on the resource group in which the alert rule is created

Creating an alert rule requires Read on the target resource and Write on the resource group that holds the rule. Write on the target resource, subscription-level Write and Delete on the resource group aren't listed as requirements.

34. A company must deploy a public IP address that will be associated with an Azure Bastion host. The IP address must be created with the correct SKU and allocation method. Which configuration meets the requirement?

  1. Basic SKU, dynamic IPv4
  2. Standard SKU, static IPv4
  3. Standard SKU, dynamic IPv4
  4. Basic SKU, static IPv4

Answer: B — Standard SKU, static IPv4

A Bastion host supports only static IPv4 public IPs (Dynamic IPv4: No, Static IPv4: Yes), which rules out A and C. Basic SKU public IPs could be static, but Basic SKU public IPs were retired on September 30, 2025, so D cannot be deployed; Standard SKU with static IPv4 is the valid configuration.

35. A web application runs on a virtual machine scale set whose instances are all in a single datacenter. The business requires the application to remain available if that datacenter fails. What should the administrator do?

  1. Deploy the scale set instances across availability zones
  2. Increase the scale set to 1,000 instances in the same location
  3. Enable autoscale so the scale set adds instances when demand rises
  4. Place the scale set behind an Azure Load Balancer only

Answer: A — Deploy the scale set instances across availability zones

A scale set alone can't protect against datacenter failures; deploying its VMs across availability zones does. More instances, autoscale or a load balancer by themselves don't remove the single-datacenter dependency.

36. A team wants to detect malware in files uploaded to blob containers and to be alerted when credentials or PII are stored inappropriately. They already use a tool that gives a unified view of performance, capacity and availability, but it only provides passive monitoring and historical analysis. Which service should they add?

  1. Azure Storage Analytics logging
  2. Microsoft Defender for Storage
  3. Azure Disk Encryption
  4. A stored access policy on each container

Answer: B — Microsoft Defender for Storage

Microsoft Defender for Storage provides proactive threat detection including malware scanning of blob uploads and sensitive data threat detection. Storage Analytics only logs requests and usage for tracing and diagnostics.

37. A hub virtual network contains a VPN gateway connected to the on-premises network. An administrator wants spoke virtual network B to use that gateway to reach on-premises resources, without deploying a gateway in the spoke. Which configuration on the peering meets the requirement?

  1. Enable Virtual network gateway or Route Server on the spoke's peering, and Remote virtual network gateway or Route Server on the hub's peering
  2. Enable Virtual network gateway or Route Server on the hub's peering, and Remote virtual network gateway or Route Server on the spoke's peering
  3. Enable only Traffic to remote virtual network on both peerings
  4. Enable only Traffic forwarded from remote virtual network on the spoke's peering

Answer: B — Enable Virtual network gateway or Route Server on the hub's peering, and Remote virtual network gateway or Route Server on the spoke's peering

The hub that owns the gateway enables gateway transit (Virtual network gateway or Route Server), and the spoke uses the remote gateway (Remote virtual network gateway or Route Server). The reverse assignment in option A is wrong because the spoke has no gateway to share.

38. An administrator must add a rule that always takes precedence over a default rule such as AllowInternetOutbound, without being able to delete the default rule. Which approach meets the requirement?

  1. Delete the default rule and recreate it with a different action.
  2. Create a custom rule with a higher Priority value than the default rule's value.
  3. Create a custom rule with a lower Priority number than the default rule's number.
  4. Disassociate the NSG and reassociate it so the defaults are regenerated in a new order.

Answer: C — Create a custom rule with a lower Priority number than the default rule's number.

Default rules cannot be removed but can be overridden by a rule processed earlier, which means a lower priority number (higher precedence). A higher number would be processed later and would not override.

39. A security team has an NSG with four separate rules that each allow a different port (80, 443, 8080, 8090) from the same source to the same destination. They want to reduce the rule count and avoid rule sprawl while still using one NSG. What should they do?

  1. Associate a second NSG to the same subnet for the additional ports
  2. Replace the destination with a service tag that groups the four ports together
  3. Create one augmented security rule that lists all four ports in the Service field
  4. Assign all four rules the same priority value so they are treated as one

Answer: C — Create one augmented security rule that lists all four ports in the Service field

Augmented security rules allow multiple ports and ranges in one rule. A subnet can have at most one NSG, service tags represent IP address prefixes of Azure services (not ports), and priority values must be unique within the NSG.

40. An administrator realizes that an existing production VM was created without an availability set and must now be placed in one. The VM is not part of any scale set. Which approach meets the requirement?

  1. Use the VM's Configuration blade to select the availability set and save
  2. Stop the VM and then add it to the availability set
  3. Delete the VM and recreate it, selecting the availability set during creation
  4. Increase the number of update domains on the availability set so the VM is included

Answer: C — Delete the VM and recreate it, selecting the availability set during creation

A VM can only be added to an availability set when it is created, so changing it requires deleting and recreating the VM. Stopping the VM or changing update domains does not add an existing VM to a set.

41. A contractor is given a service SAS for a blob container. The administrator must be able to revoke the contractor's access at any time without regenerating the storage account keys, because other applications depend on those keys. Which approach meets the requirement?

  1. Issue a user delegation SAS that references a stored access policy on the container
  2. Issue a service SAS that references a stored access policy defined on the container
  3. Issue an account SAS that references a stored access policy defined on the container
  4. Issue an ad hoc service SAS whose start time, expiry time and permissions are specified in the SAS URI

Answer: B — Issue a service SAS that references a stored access policy defined on the container

Stored access policies let you revoke permissions for a service SAS without regenerating the account keys. User delegation and account SAS tokens must be ad hoc and cannot reference a stored access policy, and an ad hoc SAS carries its constraints in the URI, so it cannot be revoked that way.

42. An administrator is planning Microsoft Entra Domain Services for a managed domain. The team wants to nest OUs, extend the schema with custom attributes, and target OUs with built-in GPOs filtered by security group. Which statement about the service is correct?

  1. Nested OUs are supported, but schema extension is not
  2. The schema can be extended, but the OU structure is flat
  3. None of the three are supported: OUs are flat, the schema cannot be extended, and built-in GPOs cannot target OUs or use security-group filtering
  4. All three are supported because the service is fully compatible with AD DS

Answer: C — None of the three are supported: OUs are flat, the schema cannot be extended, and built-in GPOs cannot target OUs or use security-group filtering

The documented limitations are a flat OU structure, no schema extension, and built-in GPOs that cannot target OUs or use WMI or security-group filtering.

43. An administrator needs to assign roles and remove those assignments at a single resource group, without being given subscription-wide Owner access. Which pair of permissions must the administrator's account have at that scope? (Choose two.)

  1. Microsoft.Authorization/roleAssignments/write
  2. Microsoft.Authorization/roleAssignments/read only
  3. Microsoft.Authorization/roleAssignments/delete
  4. Microsoft.Authorization/roleDefinitions/write
  5. Microsoft.Authorization/elevateAccess/Action

Answer: A,C — Microsoft.Authorization/roleAssignments/write / Microsoft.Authorization/roleAssignments/delete

Creating an assignment requires roleAssignments/write and removing it requires roleAssignments/delete. Read only lets you list assignments, and roleDefinitions/write concerns custom role definitions, not assignments.

44. An alert must call a third-party HTTPS endpoint that is protected with basic authentication. The team wants the action group to call it directly, without Microsoft Entra ID service principal authentication. Which action type should be configured?

  1. Secure webhook
  2. Webhook, with the credentials passed in the URI
  3. Functions
  4. Event hubs

Answer: B — Webhook, with the credentials passed in the URI

The Webhook action can use basic authentication if the credentials are passed in the URI. Secure webhook relies on Microsoft Entra ID and doesn't support basic authentication.

45. A team must guarantee that a template keeps working unchanged over time, with no risk of breaking changes introduced by later versions of the underlying Azure REST API. Which element of the resource definition in the template controls this?

  1. apiVersion
  2. contentVersion
  3. $schema
  4. The defaultValue of the location parameter

Answer: A — apiVersion

The apiVersion set on the resource is used as the API version of the REST operation Resource Manager sends, so later API changes don't affect the deployment. contentVersion is not the REST API version.

46. A test group in a connection monitor has 3 source endpoints, 4 destination endpoints and 2 test configurations. The administrator must stay within the per-connection-monitor scale limits. How many tests are created, and which limit is relevant to the number of test configurations?

  1. 9 tests; a maximum of 100 test configurations per connection monitor
  2. 24 tests; a maximum of 20 test configurations per connection monitor
  3. 24 tests; a maximum of 100 test configurations per connection monitor
  4. 12 tests; a maximum of 20 test configurations per connection monitor

Answer: B — 24 tests; a maximum of 20 test configurations per connection monitor

Every combination of source, destination and test configuration becomes a test (3 x 4 x 2 = 24), and a connection monitor allows at most 20 test configurations.

47. An administrator configures a stateful metric alert rule on a virtual machine. The alert fires, and the metric then falls back below the threshold. After how many checks is the alert condition set to resolved and a resolved notification sent?

  1. After the first check in which the condition isn't met
  2. After two consecutive checks in which the condition isn't met
  3. After three consecutive checks in which the condition isn't met
  4. After the 30-day alert retention period ends

Answer: C — After three consecutive checks in which the condition isn't met

A stateful metric alert is resolved when the condition isn't met for three consecutive checks. The 30-day period is only how long alert instances are stored, not the resolution trigger.

48. A lifecycle management rule deletes previous versions by using daysAfterCreationGreaterThan set to 30. A blob created 400 days ago is overwritten today, and its new previous version is deleted almost immediately. The administrator wants versions kept for a period measured from when they became noncurrent, with more granular control than day-based thresholds. What should they use?

  1. Azure Storage Actions
  2. A lifecycle rule with a lower daysAfterCreationGreaterThan value
  3. Blob soft delete with a 30-day retention period
  4. A lifecycle rule with a filter that excludes blobs older than 30 days

Answer: A — Azure Storage Actions

A version's age under lifecycle management is based on when its data was originally written, so a noncurrent-based retention calls for Azure Storage Actions. A lower threshold doesn't change that, and filters can only include blobs. Overwrite-created versions aren't soft-deleted, so soft delete retention doesn't apply.

49. A company policy requires a reminder every 60 days to rotate storage account access keys, and a compliance report listing accounts in a subscription whose keys haven't been rotated in time. Which two actions meet the requirement? (Choose two.)

  1. Configure a SAS expiration policy on the storage account
  2. Create a key expiration policy of 60 days on the storage account
  3. Create a stored access policy on each container
  4. Assign the built-in Azure Policy definition "Storage account keys should not be expired" at the subscription scope
  5. Disallow Shared Key authorization on the storage account

Answer: B,D — Create a key expiration policy of 60 days on the storage account / Assign the built-in Azure Policy definition "Storage account keys should not be expired" at the subscription scope

A key expiration policy sets the rotation reminder (for example with --key-exp-days 60), and the built-in Azure Policy definition reports accounts whose keys weren't rotated within the interval. A SAS expiration policy applies to service and account SAS validity, and a stored access policy manages SAS constraints, so neither concerns key rotation.

50. An administrator is preparing to swap a staging slot into production. The staging slot has a custom domain name, IP restrictions, and a connection string that has not been marked as slot-specific. Which of these elements will move with the app content to production during the swap?

  1. The custom domain name
  2. The IP restrictions
  3. The connection string
  4. The scale settings

Answer: C — The connection string

Connection strings are swapped by default (they can be configured to be slot-specific). Custom domain names, IP restrictions and scale settings are slot-specific and stay in the source slot.

51. An administrator used the portal to move a single-instance VM from a regional to a zonal deployment in the same subscription. Which two items must be reconfigured manually on the target VM? (Choose two.)

  1. RBAC role assignments
  2. Tags
  3. User-assigned managed identities
  4. The disks attached to the source VM
  5. VM extensions

Answer: A,E — RBAC role assignments / VM extensions

Only tags and user-assigned managed identities are replicated to the target zone, so RBAC, policies and extensions must be reconfigured. The attached disks are recreated automatically in the target zonal configuration.

52. An administrator is mapping the root domain contoso.com to an App Service app. Which two DNS records should be created at the domain provider? (Choose two.)

  1. An A record with host @ that uses the app's IP address
  2. A TXT record with host asuid that holds the domain verification ID
  3. A CNAME record with host @ that points to the app's default hostname
  4. A TXT record with host asuid.www that holds the domain verification ID
  5. A CNAME record with host www that points to the app's default hostname

Answer: A,B — An A record with host @ that uses the app's IP address / A TXT record with host asuid that holds the domain verification ID

A root domain uses an A record on @ plus an asuid TXT record for ownership verification. CNAME isn't recommended for a root domain, and the www and asuid.www records apply to the subdomain scenario.

53. An administrator is creating a public IP address that will be used with a Standard public load balancer that is a cross-region load balancer. Which two settings must the public IP address match to the load balancer? (Choose two.)

  1. The SKU of the public IP address must match the SKU of the load balancer
  2. The IP version must be IPv6 to match the load balancer
  3. The tier of the public IP address must match the load balancer tier
  4. The assignment must be dynamic so the address can follow the load balancer
  5. The IP address must be created in the gateway subnet of the virtual network

Answer: A,C — The SKU of the public IP address must match the SKU of the load balancer / The tier of the public IP address must match the load balancer tier

A public IP's SKU must match the SKU of the load balancer, and the tier must match the load balancer tier. IPv4 and IPv6 are charged at the same rate and no version match is required by the document.

54. An organization wants to test Microsoft Entra functionality without affecting its production directory, and needs its existing users and groups to manage resources in two Azure subscriptions via RBAC. Which statement describes what is possible?

  1. Create a second tenant for testing; one tenant can be associated with both subscriptions, but each subscription is associated with only one tenant
  2. Associate each subscription with two tenants so users from both can be granted RBAC roles
  3. Only one tenant can exist per Azure subscription, so testing must use a separate OU
  4. Each subscription must have its own tenant, so the same users cannot manage both subscriptions

Answer: A — Create a second tenant for testing; one tenant can be associated with both subscriptions, but each subscription is associated with only one tenant

Multiple tenants can be created for testing, and a single tenant can be associated with multiple subscriptions, but a subscription is associated with exactly one tenant. Entra ID has no OUs, so option C is wrong.

55. Blob soft delete was just enabled on a flat-namespace storage account. A workload that connects through the *.dfs.core.windows.net endpoint now fails with EndpointUnsupportedAccountFeatures. The administrator must keep soft delete enabled and must not change the account's namespace type. What should they do?

  1. Extend the soft delete retention period to 365 days
  2. Enable blob versioning on the account
  3. Change the workload to use the *.blob.core.windows.net endpoint
  4. Enable the Permanent Delete feature

Answer: C — Change the workload to use the *.blob.core.windows.net endpoint

On a flat-namespace account, soft delete blocks the DFS endpoint, so the workload must use the Blob endpoint. Retention, versioning and Permanent Delete don't affect endpoint availability.

56. A company has an on-premises hybrid application and an Azure IaaS VM that both connect to the same storage account endpoint. The administrator must continuously measure latency between endpoints, including the on-premises host, and detect changes such as modified NSG rules. What must be done to use this tool for the on-premises host?

  1. Enable flow logs on the NSG protecting the host
  2. Install a monitoring agent on the on-premises host
  3. Run IP flow verify against the on-premises host
  4. Nothing, because Network Watcher is enabled automatically for all hosts

Answer: B — Install a monitoring agent on the on-premises host

Connection Monitor needs monitoring agents installed on the hosts it monitors, including on-premises hosts. IP flow verify and flow logs do not measure latency continuously across hybrid endpoints.

57. A user is assigned Reader on a resource group through one role assignment and is also a member of a group that has Contributor on the same resource group. No deny assignments or conditions apply. What access does the user have on the resources in that group?

  1. Read-only, because the most restrictive assignment wins
  2. Read and write, because the permissions from both assignments are combined
  3. No access, because conflicting assignments cancel each other out
  4. Read-only, because direct assignments override group assignments

Answer: B — Read and write, because the permissions from both assignments are combined

Azure RBAC is an allow model in which role assignments are additive, so the user gets the permissions of both. Nothing in the model makes the more restrictive or the direct assignment win.

Take this test interactively

More Microsoft Azure Administrator (AZ-104) practice tests