Free Preparation Discussions
MENU
Microsoft AZ-104 Exam Questions
- Topic 1: Manage Azure identities and governance: This section of the exam covers how to oversee Azure AD objects, role-based access control, and other governance-based features to secure resources.
- Topic 2: Implement and manage storage: This section of the exam covers increasing skills related to overseeing and setting up Azure storage accounts, file shares, and blob storage.
- Topic 3: Deploy and manage Azure compute resources: This section of the exam covers comprehension of implementing, setting up, and managing virtual machines, App Services, and container instances.
- Topic 4: Implement and manage virtual networking: This section of the exam covers how to oversee and manage virtual networks, Azure domain name systems, and network security groups.
- Topic 5: Monitor and maintain Azure resources: In this section, the candidates are tested for their skills in monitoring Azure resources after utilizing the Azure Monitor. It also includes setting up alerts and adopting backup and recovery solutions.
Free Microsoft AZ-104 Exam Actual Questions
Note: Premium Questions for AZ-104 were last updated On Mar. 10, 2026 (see below)
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles;
* Reader
* Security Admin
* Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?
https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles#:~:text=The%20User%20Access%20Administrator%20role%20enables%20the%20user%20to%20grant,Azure%20subscriptions%20and%20management%20groups.
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.
Solution: You configure a custom policy definition, and then you assign the Azure policy to the subscription.
Does this meet the goal?
In Azure, Azure Policy is a governance tool used to enforce organizational standards and assess compliance across Azure resources. It allows administrators to define and assign policy definitions that automatically audit, deny, or modify resource configurations at deployment or runtime.
In this scenario, the requirement is that every time a Network Security Group (NSG) is created, it should automatically contain a rule that blocks TCP port 8080 traffic between virtual networks.
The Microsoft Azure Policy documentation confirms that you can create a custom policy definition using the Microsoft.Network/networkSecurityGroups/securityRules resource type. Within the policy's JSON definition, you can specify conditions such as:
The resource type to which the policy applies (networkSecurityGroups).
The enforcement mode (deny or deployIfNotExists).
The required configuration, such as a specific inbound or outbound rule (in this case, a rule denying TCP 8080).
By using the DeployIfNotExists effect in the policy, Azure automatically ensures that the NSG includes the required rule. If the rule does not exist, Azure deploys it automatically during resource creation.
Assigning this custom policy definition at the subscription level ensures it is inherited by all resource groups and applies to all virtual networks created in that subscription. This meets the goal because the requirement is to enforce a security configuration across all NSGs, regardless of which resource group or virtual network they belong to.
Therefore, configuring and assigning a custom Azure Policy to the subscription fully satisfies the requirement.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.
Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1
The Traffic Manager Contributor role is not related to Traffic Analytics. Traffic Manager is a service that provides DNS-based load balancing and traffic routing across different regions and endpoints.Traffic Manager Contributor is a role that allows you to create and manage Traffic Manager profiles, endpoints, and geographies1.
Traffic Analytics is a service that provides visibility into user and application activity in your cloud networks. Traffic Analytics analyzes Azure Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud.With Traffic Analytics, you can visualize network activity, identify hot spots, secure your network, optimize your network deployment, and pinpoint network misconfigurations2.
To enable Traffic Analytics for an Azure subscription, you need to have a role that grants you the following permissions at the subscription level:
Microsoft.Network/applicationGateways/read
Microsoft.Network/connections/read
Microsoft.Network/loadBalancers/read
Microsoft.Network/localNetworkGateways/read
Microsoft.Network/networkInterfaces/read
Microsoft.Network/networkSecurityGroups/read
Microsoft.Network/publicIPAddresses/read
Microsoft.Network/routeTables/read
Microsoft.Network/virtualNetworkGateways/read
Microsoft.Network/virtualNetworks/read
Microsoft.OperationalInsights/workspaces/*
Some of the built-in roles that have these permissions are Owner, Contributor, or Network Contributor3. However, these roles also grant other permissions that may not be necessary or desirable for enabling Traffic Analytics.Therefore, the best practice is to use the principle of least privilege and create a custom role that only has the required permissions for enabling Traffic Analytics4.
Therefore, to meet the goal of ensuring that an Azure AD user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription, you should create a custom role with the required permissions and assign it to Admin1 at the subscription level.
Which blade should you instruct the finance department auditors to use?
You can opt in and configure additional recipients to receive your Azure invoice in an email. This feature may not be available for certain subscriptions such as support offers, Enterprise Agreements, or Azure in Open.
Select your subscription from the Subscriptions page. Opt-in for each subscription you own. Click Invoices then Email my invoice.
Click Opt in and accept the terms.
Scenario: During the testing phase, auditors in the finance department must be able to review all Azure costs from the past week.
You need to configure WebApp1 to meet the technical requirements.
Which certificate can you use from Vault1?
- Select Question Types you want
- Set your Desired Pass Percentage
- Allocate Time (Hours : Minutes)
- Create Multiple Practice tests with Limited Questions
- Customer Support
Jolene
6 days agoOzell
13 days agoLaurena
21 days agoEric
28 days agoCarole
1 month agoKimbery
1 month agoGeoffrey
2 months agoCarman
2 months agoElza
2 months agoCristy
2 months agoStevie
3 months agoMagdalene
3 months agoNadine
3 months agoJustine
3 months agoDerrick
4 months agoStephen
4 months agoPolly
4 months agoLizbeth
4 months agoNobuko
5 months agoJannette
5 months agoNicolette
5 months agoGaynell
5 months agoStefania
6 months agoHuey
6 months agoRanee
6 months agoOmega
6 months agoLuis
6 months agoSonia
6 months agoJanna
8 months agoAlyce
8 months agoMauricio
9 months agoLaine
9 months agoJohnna
11 months agoMicaela
12 months agoBettina
12 months agoDorsey
1 year agoStephanie
1 year agoHoward
1 year agoDonette
1 year agoBritt
1 year agoMicaela
1 year agoMireya
1 year agoDeandrea
1 year agoKenneth
1 year agoLashon
1 year agoCecil
1 year agoIola
1 year agoRebecka
1 year agoRhea
1 year agoDesiree
1 year agoChuck
1 year agoGail
1 year agoTerry
1 year agoCorrinne
1 year agoGwenn
1 year agoGianna
1 year agoEmogene
1 year agoJuliana
1 year agoAja
1 year agoLindsey
1 year agoDevorah
2 years agoFelix
2 years agoCiara
2 years agoRessie
2 years agoOretha
2 years agoAdelaide
2 years agoMari
2 years agoLetha
2 years agoalizabeth
2 years agoMark james
2 years agoJAZZY
2 years agolivingston
2 years agohamim
2 years agopelvis
2 years agosijag
2 years agogarey
2 years ago