AZ-104 Practice Questions — Free

Question 1 of 25

A company wants to apply a consistent policy across multiple Azure subscriptions belonging to the same department, without configuring the policy separately in each one. What Azure construct groups subscriptions for this purpose?

• A.A Microsoft Entra ID tenant, which is a separate identity boundary, not a subscription-grouping construct
• B.An Azure Policy initiative alone, without a management group, cannot span multiple subscriptions
• C.A management group, allowing policies and RBAC to be applied hierarchically across multiple subscriptionsCorrect
• D.A resource group, which organizes resources within a single subscription, not across subscriptions

Question 2 of 25

An administrator wants an Azure Policy assignment to apply only to resources within a specific resource group, not the entire subscription it belongs to. What should be configured on the policy assignment?

• A.A management group assignment, which applies above the subscription level, not narrower than it
• B.The assignment's scope set to the subscription, which would apply far more broadly than intended
• C.The assignment's scope set specifically to that resource groupCorrect
• D.Policy assignments can only ever be scoped to an entire subscription, never a single resource group

Question 3 of 25

An administrator must review Global Administrator holders and require them to justify continued membership quarterly. What should be set up?

• A.A budget alert configured on administrator account activity
• B.An NSG rule restricting administrator sign-in traffic
• C.A resource lock applied to each administrator account
• D.A recurring access review on the Global Administrator roleCorrect

Question 4 of 25

A company's Azure Policy assignment currently uses an Audit effect for a tagging requirement, and the compliance team now wants non-compliant resources to be blocked at creation instead. What change should be made?

• A.Enable a resource lock account-wide, which is unrelated to changing a policy's enforcement effect
• B.Delete the policy entirely, since Audit-effect policies cannot ever be changed to Deny
• C.Update the policy assignment's effect from Audit to DenyCorrect
• D.Add an RBAC role assignment, since RBAC alone is what actually blocks resource creation

Question 5 of 25

A university has 12 departmental subscriptions and must apply the same tag and location policies to all of them at once. What should be created?

• A.A resource lock applied individually to each subscription
• B.A management group containing them, with policies assigned thereCorrect
• C.Twelve identical policy assignments made on each subscription
• D.A single new subscription consolidating all twelve

Question 6 of 25

An administrator must ensure a file share snapshot exists before a risky migration and can be reverted quickly. What should be taken?

• A.A snapshot of the VM mounting the share
• B.An Azure Files share snapshotCorrect
• C.A blob version of the share's contents
• D.A storage account backup via geo-replication

Question 7 of 25

A storage account must be moved to another subscription. What is true?

• A.It can be moved intact with the move operationCorrect
• B.The account must be deleted and recreated
• C.Data must be copied manually to a new account
• D.Storage accounts cannot change subscriptions

Question 8 of 25

An administrator must disable shared key authorization on a storage account so only Entra ID access works. What is the effect on existing tools using account keys?

• A.They fail until switched to Entra ID or SAS authenticationCorrect
• B.They continue working unchanged with the account key
• C.They automatically switch to Entra ID authentication
• D.Only upload operations are affected by the change

Question 9 of 25

A developer wants a way to copy large amounts of data efficiently between two Azure Storage accounts, or between on-premises storage and Azure, from the command line as part of a scripted process. What tool is purpose-built for this?

• A.A resource lock, which prevents resource deletion/modification, unrelated to data copying
• B.Azure Monitor, which observes resource metrics and logs rather than copying data
• C.Azure Policy, which governs resource configuration rather than performing data copy operations
• D.AzCopy, a command-line tool optimized for high-performance data copying to/from Azure StorageCorrect

Question 10 of 25

An administrator must ensure a container's blobs are only accessible with a SAS whose permissions can be revoked centrally. What should the SAS be based on?

• A.The storage account key used directly
• B.A resource lock applied to the container
• C.Anonymous read access on the container
• D.A stored access policy on the containerCorrect

Question 11 of 25

A Windows VM must automatically install OS updates during a defined maintenance window. What service manages this?

• A.Azure Backup with a nightly backup policy
• B.A resource lock applied to the virtual machine
• C.The VM's auto-shutdown schedule setting
• D.Azure Update Manager with a maintenance configurationCorrect

Question 12 of 25

An App Service app must run continuously with a custom domain and a managed TLS certificate. What plan tier is required at minimum?

• A.Shared tier
• B.Basic tierCorrect
• C.Consumption tier
• D.Free tier

Question 13 of 25

An administrator wants to run a containerized workload without provisioning and managing the underlying VM infrastructure at all, for a scenario simpler than a full Kubernetes cluster. What Azure service fits this?

• A.Azure Container Instances (ACI), running containers without managing underlying VMsCorrect
• B.Azure Kubernetes Service (AKS), which involves managing a full cluster, more than this scenario needs
• C.A Virtual Machine Scale Set, which still requires managing the underlying VM infrastructure
• D.Azure Disk Storage, a storage service rather than a container hosting platform

Question 14 of 25

A steady production VM will run 24x7 for at least three years. What lowers its cost most?

• A.Spot pricing with a maximum price set
• B.Pay-as-you-go pricing with no commitment
• C.A three-year Reserved Instance for the VM sizeCorrect
• D.Auto-shutdown scheduled outside business hours

Question 15 of 25

A VM must be pinned to a physical host the organization controls for licensing isolation. What should be used?

• A.An availability set
• B.A virtual machine scale set
• C.A proximity placement group
• D.Azure Dedicated HostCorrect

Question 16 of 25

A scale set must always keep at least 2 instances and never exceed 10. Where is this defined?

• A.The NSG associated with the scale set's subnet
• B.The VM size chosen for the scale set instances
• C.The route table associated with the subnet
• D.The autoscale profile's minimum and maximumCorrect

Question 17 of 25

An administrator wants outbound traffic from a VNet to reach the internet through a fixed, predictable public IP address, rather than an unpredictable, platform-assigned one. What should be configured?

• A.A NAT Gateway with an associated static public IP addressCorrect
• B.A Network Security Group, which filters traffic rather than controlling the outbound source IP
• C.Azure Bastion, which provides secure inbound VM access rather than a predictable outbound IP
• D.VNet peering, which connects virtual networks rather than controlling an outbound public IP

Question 18 of 25

An administrator wants VMs in a VNet to resolve names like db.internal.contoso to private IPs. What should be created?

• A.An Azure Private DNS zone linked to the VNetCorrect
• B.A public DNS zone hosting the internal record names
• C.A NAT gateway providing outbound name resolution
• D.An NSG rule permitting DNS traffic on port 53 outbound

Question 19 of 25

An administrator must apply the same NSG rules to all web servers regardless of subnet or IP. What should be used?

• A.An application security group referenced in NSG rulesCorrect
• B.One NSG created and maintained per virtual machine
• C.A public IP prefix reserved for the web server NICs
• D.A route table associated with each web server subnet

Question 20 of 25

An administrator must confirm which NSG rule is allowing unexpected traffic. What Network Watcher tool identifies the specific rule?

• A.Connection monitor between two endpoints
• B.IP flow verify, which names the matching ruleCorrect
• C.Packet capture on the network interface
• D.Next hop route evaluation for the VM

Question 21 of 25

An administrator must confirm that a VNet's address space can be expanded after creation. What is true?

• A.Address space is fixed once the VNet has been created
• B.The VNet must be deleted and recreated to change it
• C.Only subnets can be added, never new address ranges
• D.Address space can be added, unless it overlaps a peered VNetCorrect

Question 22 of 25

An administrator must retain security-relevant logs for 2 years, longer than the workspace default. What should be configured?

• A.The workspace's data retention or archive settingsCorrect
• B.Metric alert rules configured on the workspace
• C.A storage account SAS with a two-year expiry
• D.A resource lock on the Log Analytics workspace

Question 23 of 25

A company wants to configure automated backups for a set of Azure VMs, with a defined retention policy and the ability to restore a VM to a specific point in time. What Azure service fits this?

• A.Azure Backup, using a Recovery Services vault with a defined backup policyCorrect
• B.Network Watcher, a networking diagnostics tool rather than a VM backup service
• C.A resource lock, which prevents deletion/modification rather than performing scheduled backups
• D.Blob lifecycle management, which manages storage tiering rather than VM-level backup and restore

Question 24 of 25

An organization must keep a snapshot of a VM's disk immediately before a risky change, outside the normal backup schedule. What should be taken?

• A.A resource lock applied to the disk
• B.An export of the subscription's Activity Log
• C.An on-demand backup or a managed disk snapshotCorrect
• D.A budget alert configured for the VM

Question 25 of 25

An administrator must confirm the last successful backup of a VM. Where is this shown?

• A.The VM's backup blade or the vault's backup itemsCorrect
• B.The NSG associated with the VM's subnet
• C.Cost Management's usage view for the vault
• D.Azure Advisor's reliability recommendations