AZ-104 sample questions with answers
The other 82 questions are in the practice tool, with answers revealed as you go.
Start 20 questionsManage Azure identities and governance
- A platform team needs an identity for an unattended deployment script that will read and write resources in an Azure subscription. The identity must not be tied to a person and must be able to hold its own credentials. Which identity type should the team create?
- An operator must be able to start, stop and reconfigure virtual machines in one resource group, and must have no rights anywhere else in the subscription. Which mechanism should be used?
- An administrator wants to assign a custom rule that permits only a specific list of virtual machine sizes. What must exist before that assignment can be created?
- An administrator must create 500 new cloud-only user accounts in Microsoft Entra ID and wants to submit them in one operation using a comma-separated template downloaded from the portal. Which approach should be used?
- A user's password has expired. The account is enabled, licensed and not locked out, yet the user cannot sign in to any application. What should be attempted first?
- A company wants administrators to hold no standing privileged role. Instead they should request elevation for a few hours, with approval and MFA, and every activation must be auditable. Which feature provides this?
- A custom role definition must grant read access to every resource type from every resource provider, and nothing else. Which actions entry accomplishes this?
- A policy must add a tag with a fixed value to a resource request when, and only when, that tag is absent, without altering any other property. Which effect does this?
- Which combination provides the strongest protection for a highly privileged directory role?
- Quarterly access reviews will cover all guest users in the tenant. Which reviewer options does Microsoft Entra access reviews support?
- After a Conditional Access policy blocks legacy authentication, staff using an old mail client can no longer connect. What resolution keeps the security posture intact?
Implement and manage storage
- A company stores log archives in Blob Storage. Files are written once, rarely read after the first month, and must be kept for one year. The company wants the lowest storage cost per GB and accepts that retrieving a file can take hours. Which access tier fits best?
- A company stores customer records in a storage account. During a regional outage, the team must still be able to read the data without waiting for a failover. Which TWO redundancy options meet this read-during-outage requirement?
- An operations team wants to recover blobs that were accidentally overwritten or deleted, without restoring from backup. They also want to be able to see earlier states of each blob. Which combination of blob data protection features fits best?
- An automation script must give a partner temporary read access to one blob. Security policy forbids storing or using the storage account key in the script. The script runs under a managed identity that holds the Storage Blob Data Reader and Storage Blob Delegator roles. Which token should the script create?
Implement and manage virtual networking
- A company runs a web app behind an Application Gateway WAF v2 deployed in a dedicated subnet. After someone attaches a new network security group to that subnet, backend health shows Unknown and clients receive 502 errors. Which TWO NSG rules would restore the gateway's health communication?
- A VM cannot reach an on-premises server. An engineer suspects a user-defined route is sending traffic to the wrong place. Which Network Watcher tool should be used first to show the next hop Azure selects for a packet from that VM to the on-premises address?
- An engineer is preparing a VNet to host a site-to-site VPN gateway. The deployment fails because the subnet name is not accepted. Which subnet name is required for a VPN gateway?