Question 1

AZ-104: Users must only create resources in approved Regions

Accepted Answer

Assign the Allowed locations policy at the management group or subscription with Deny effect. RBAC controls who can act, not what a resource may look like.

Question 2

AZ-104: Nobody, even an owner, may delete a production resource group by accident

Accepted Answer

Add a CanNotDelete lock on the resource group. Locks apply regardless of role. ReadOnly would also block normal updates.

Question 3

AZ-104: A user needs to manage VMs but not assign access

Accepted Answer

Assign Virtual Machine Contributor (or Contributor) at the resource group. Contributor can't assign roles; Owner and User Access Administrator can.

Question 4

AZ-104: Delegate role assignment but not resource management

Accepted Answer

Assign User Access Administrator (or RBAC Administrator) at the needed scope. These roles manage access only and carry no resource rights.

Question 5

AZ-104: Give the same access to every subscription, including new ones

Accepted Answer

Put subscriptions in a management group and assign the role or policy there. Assignments inherit down the hierarchy.

Question 6

AZ-104: Licence assignment fails for a new user

Accepted Answer

Set the user's usage location, then assign the licence. Licences can't be assigned without a usage location.

Question 7

AZ-104: Assign licences automatically by department

Accepted Answer

Create a dynamic user group on the department attribute and assign the licence to the group (Entra ID P1). Membership and licences follow the attribute.

Question 8

AZ-104: Users reset passwords themselves and the on-premises password must change too

Accepted Answer

Enable SSPR for the group and turn on password writeback through Entra Connect (P1). Without writeback the cloud reset doesn't reach on-premises AD.

Question 9

AZ-104: Every resource must carry a CostCenter tag copied from its resource group

Accepted Answer

Assign the built-in Inherit a tag from the resource group policy, and remediate existing resources. Tags aren't inherited by default.

Question 10

AZ-104: Spending must trigger an automatic action at 90% of budget

Accepted Answer

Create a budget with an alert at 90% linked to an action group that runs automation. Budgets alert only; automation does the stopping.

Question 11

AZ-104: Moving a subscription to a different tenant

Accepted Answer

Plan to recreate RBAC assignments and managed identities after changing directory. Changing directory removes them.

Question 12

AZ-104: Survive the loss of one datacentre in a Region at the lowest cost

Accepted Answer

Use zone-redundant storage. It replicates across zones synchronously; GRS costs more and is for regional loss.

Question 13

AZ-104: Survive a regional outage and read from the secondary during it

Accepted Answer

Use a read-access geo-redundant option. Plain GRS exposes the secondary only after failover.

Question 14

AZ-104: Partner needs temporary read access and you must be able to revoke it

Accepted Answer

Issue a service SAS bound to a stored access policy; delete the policy to revoke. An ad hoc SAS can only be revoked by rotating the account key.

Question 15

AZ-104: Most secure SAS for blobs

Accepted Answer

Sign the SAS with Entra credentials instead of the account key. It doesn't expose the key and ties to RBAC.

Question 16

AZ-104: Only one subnet in a VNet may reach the storage account

Accepted Answer

Enable the Microsoft.Storage service endpoint on the subnet, add a VNet rule and set default action Deny. Traffic is then allowed only from that subnet.

Question 17

AZ-104: On-premises systems must reach storage over a private IP

Accepted Answer

Create a private endpoint and a privatelink DNS zone. Service endpoints don't work from on-premises.

Question 18

AZ-104: Firewall rule for an office's private 10.x range

Accepted Answer

Use the public IP of the office, a VNet rule, or a private endpoint. IP rules reject private address ranges.

Question 19

AZ-104: Azure Backup or Event Grid can't reach a locked-down account

Accepted Answer

Enable Allow trusted Microsoft services to access this storage account. It lets listed first-party services bypass the firewall.

Question 20

AZ-104: Move logs to cool after 30 days and delete after 2 years, automatically

Accepted Answer

Add a lifecycle rule with tierToCool and delete on days since modification. It runs daily with no manual work.

Question 21

AZ-104: Recover a blob that was overwritten

Accepted Answer

Enable blob versioning and promote the earlier version. Soft delete alone covers deletes and overwrites only within its retention, versioning is purpose-built.

Question 22

AZ-104: Replicate blobs to an account in another Region automatically

Accepted Answer

Enable versioning on both accounts and change feed on the source, then add a replication policy. These are the prerequisites.

Question 23

AZ-104: Domain users open an Azure Files share with their own credentials

Accepted Answer

Enable AD DS, Entra Domain Services or Entra Kerberos auth, give a share-level RBAC role, set NTFS ACLs. Share roles and file ACLs are two layers.

Question 24

AZ-104: Copy a large dataset into Blob Storage from a script

Accepted Answer

Run azcopy copy or sync with azcopy login or a SAS URL. AzCopy is built for bulk transfer and doesn't use account keys.

Question 25

AZ-104: Preview a template deployment before it changes anything

Accepted Answer

Run az deployment group what-if. It shows creates, modifies and deletes.

Question 26

AZ-104: Deploy a template and remove resources not in it

Accepted Answer

Deploy with --mode Complete. Incremental leaves other resources untouched.

Question 27

AZ-104: Turn an existing ARM template into Bicep

Accepted Answer

Run az bicep decompile --file template.json. It converts best effort; check the output.

Question 28

AZ-104: Protect VMs from rack failure and planned maintenance in one datacentre

Accepted Answer

Place VMs in an availability set with fault and update domains. Zones are the choice for datacentre failure.

Question 29

AZ-104: Highest VM SLA within one Region

Accepted Answer

Spread VMs across zones behind a zone-redundant load balancer. 99.99% versus 99.95% for a set.

Question 30

AZ-104: Encrypt the OS and data disks with BitLocker, keys in Key Vault

Accepted Answer

Enable ADE with a vault in the same Region and subscription, enabled for disk encryption. ADE runs inside the guest using BitLocker or dm-crypt.

Question 31

AZ-104: Encrypt temp disk and caches too

Accepted Answer

Enable encryption at host on the VM. Server-side disk encryption alone doesn't cover the temp disk.

Question 32

AZ-104: Move a VM to a different Region

Accepted Answer

Use Azure Resource Mover or replicate with Site Recovery and fail over. A resource-group or subscription move never changes Region.

Question 33

AZ-104: Add instances automatically when CPU stays above 70%

Accepted Answer

Autoscale rule on average CPU with min, max and a matching scale-in rule. Rules need a cooldown and a gap to avoid flapping.

Question 34

AZ-104: Run one short container with no cluster to manage

Accepted Answer

Use ACI with the right restart policy. It's the simplest run-a-container service, but has no autoscale.

Question 35

AZ-104: Containers must scale on HTTP load and down to zero

Accepted Answer

Deploy to Container Apps with a KEDA HTTP rule and min replicas 0. ACI can't autoscale.

Question 36

AZ-104: Geo-replicate images and use a private endpoint for the registry

Accepted Answer

Use the Premium SKU. Basic and Standard lack geo-replication and private link.

Question 37

AZ-104: Test a new web app version and roll back instantly

Accepted Answer

Deploy to a staging slot, warm up, swap, swap back if needed (Standard tier or higher). Swap is near zero downtime.

Question 38

AZ-104: Staging database connection string must not move during a swap

Accepted Answer

Mark the setting as a deployment slot setting. Sticky settings stay with the slot.

Question 39

AZ-104: Point contoso.com (apex) at an App Service

Accepted Answer

Add an A record to the app IP and a TXT asuid record for verification, then bind a certificate. Apex names can't use a CNAME.

Question 40

AZ-104: Web app must call a database in a VNet

Accepted Answer

Enable regional VNet integration on a delegated subnet. It's outbound only. A private endpoint is for inbound access.

Question 41

AZ-104: Two VNets can't reach each other after peering one way

Accepted Answer

Create the peering in both VNets and check Connected status. Each side needs its own link.

Question 42

AZ-104: Spoke A needs to reach spoke B through a hub

Accepted Answer

Route via the hub firewall with a UDR, enable IP forwarding and allow forwarded traffic on peerings. Peering isn't transitive.

Question 43

AZ-104: Send all internet-bound traffic through a firewall

Accepted Answer

Route table with 0.0.0.0/0 to the firewall as a virtual appliance, attached to the subnet. Routes attach to subnets, and a user route beats the system route.

Question 44

AZ-104: Why was traffic blocked even though an Allow rule exists

Accepted Answer

Inspect effective security rules; a lower-numbered Deny, or the other NSG (subnet or NIC), may block it. Lowest priority wins and both NSGs must allow.

Question 45

AZ-104: Which NSG rule blocks one specific flow

Accepted Answer

Run Network Watcher IP flow verify. It names the rule.

Question 46

AZ-104: Where does a packet from this VM go next

Accepted Answer

Use Network Watcher Next hop. It exposes UDR mistakes.

Question 47

AZ-104: Admin access to VMs without public IPs or open ports

Accepted Answer

Deploy Bastion in AzureBastionSubnet (/26) and connect from the portal. RDP and SSH go over TLS 443.

Question 48

AZ-104: Web tier may reach app tier only on 8080 with no IP lists

Accepted Answer

Put NICs in ASGs and write the NSG rule between the ASGs. Rules follow workloads instead of addresses.

Question 49

AZ-104: Allow a SQL database to be reached only through a private IP

Accepted Answer

Create the endpoint, link privatelink DNS zone to the VNet, then disable public access. DNS must return the private IP.

Question 50

AZ-104: VMs register names automatically inside a VNet

Accepted Answer

Link the VNet to a private zone with registration enabled. Resolution-only links don't register records.

Question 51

AZ-104: Domain bought elsewhere must be hosted in Azure DNS

Accepted Answer

Create the public zone and set the registrar's NS records to Azure's name servers. Azure DNS doesn't register domains.

Question 52

AZ-104: Load balance non-HTTP TCP traffic across VMs in a Region

Accepted Answer

Create a Standard load balancer with a health probe and rule. Layer 4 service for any TCP or UDP port.

Question 53

AZ-104: Route by URL path and block SQL injection

Accepted Answer

Use Application Gateway WAF v2 with path-based rules. Only a layer 7 gateway understands URLs.

Question 54

AZ-104: Fail over a web app between Regions with DNS

Accepted Answer

Priority routing profile across regional endpoints. DNS-based routing works for any endpoint.

Question 55

AZ-104: All back-end VMs show unhealthy in a load balancer

Accepted Answer

Check the probe port is listening, NSG allows AzureLoadBalancer, guest firewall allows 168.63.129.16. The probe comes from that address.

Question 56

AZ-104: Keep resource logs for years cheaply

Accepted Answer

Send logs to a storage account with retention. Workspace retention costs more for archival.

Question 57

AZ-104: Collect memory and disk counters from VMs

Accepted Answer

Install AMA with a data collection rule. Guest metrics aren't platform metrics.

Question 58

AZ-104: Alert when a VM is deleted

Accepted Answer

Activity log alert on the delete operation with an action group. Deletes are control-plane events.

Question 59

AZ-104: Mute notifications during a maintenance window

Accepted Answer

Create an alert processing rule that suppresses notifications on a schedule. No need to edit each alert rule.

Question 60

AZ-104: See process dependencies between VMs

Accepted Answer

Enable VM insights with the Dependency agent. Without that agent the Map is empty.

Question 61

AZ-104: Continuous latency and loss tests between VMs

Accepted Answer

Create a Connection Monitor with a test group and alerts. Connection troubleshoot is a one-time test.

Question 62

AZ-104: Back up Azure VMs and Azure Files

Accepted Answer

Create the vault in the same Region and attach a policy. Backup vaults cover blobs, disks and PostgreSQL.

Question 63

AZ-104: Restore into the paired Region after a regional outage

Accepted Answer

Use a GRS vault with CRR enabled before the outage. It can't be enabled afterwards for lost data.

Question 64

AZ-104: Change vault redundancy to LRS

Accepted Answer

Switch redundancy first; once items are protected it's locked. Only an empty vault can change.

AZ-104 question patterns

Find a pattern

In this list

Identity and governance

Storage

Compute

Networking

Monitoring and backup