Free AZ-104 Practice Test – 20 Questions with Explanations

Contoso is launching Project Aquila in Australia East. Developer identities must be cloud-only and provisioned today. Blob access must use data-plane RBAC only and be revocable by removing users from one group. Build agents egress through a NAT Gateway with dynamic public IP addresses.
You must onboard 50 developers and grant least-privilege blob access with a single change point. Scope must be the storage account, with no keys, SAS tokens, or on-premises synchronization. Which approach should you use?

Your company’s Azure subscription contains an Azure virtual machine.
You need to back up the virtual machine every 12 hours.
What should you create first?

Security requires private inbound access to an App Service, no public Internet access to the app, private outbound connectivity to Azure SQL through its private endpoint, and correct private DNS resolution for both services.

Which single row meets the requirements?

Finance needs invoice access and cost analysis for a single subscription to reconcile monthly charges. They must not have permission to create, modify, or delete Azure resources. The solution should use built-in roles with minimal overhead.
Requirements
– View invoices and charges
– Analyze costs for the subscription
– No resource management rights
Which option should you choose?

A data lake team wants to protect against accidental overwrites and deletions of blobs and also guard against entire container deletion. They want a 30-day recovery window and must be able to self-restore without backup.
Which THREE actions together meet the goal?

You need a public endpoint for a Standard Load Balancer that is static, zone-redundant across Zones 1-3 in Australia East, and compatible with production security features. The IP must not change during maintenance, and you prefer the modern SKU.
Which public IP configuration should you create?

Goal: From AppSubnet, send internet traffic through NVA1, keep on-prem routes via the hub gateway.
Constraint: Use user-defined routes (RouteTable1) on AppSubnet.
BGP from the hub is advertising a default route (0.0.0.0/0) that is appearing in AppSubnet’s effective routes, bypassing NVA1 during tests. You have to ensure RouteTable1 on AppSubnet ignores propagated gateway routes and keeps using the UDR to NVA1 for internet.
What should you configure on RouteTable1?

Compliance mandates customer-managed keys (CMK) for a production storage account. Keys are held in Azure Key Vault or Managed HSM and rotated periodically. Operations wants automatic key version pickup without code changes, and security wants the storage account to have only the minimal key permissions it needs.
Requirements
– Use CMK for encryption at rest
– Auto-update to the latest key version upon rotation
– Grant only required permissions to the storage account identity
Which option should you choose?

You must enforce tagging across a subscription. New resources must include CostCenter or be denied, existing resources missing Department must be backfilled with Department=IT, and rg-exempt must be excluded.

Which single row meets the goal?

You have an Azure subscription named Sub1.
You plan to deploy a multi-tiered application that will contain the tiers shown in the following table.

You need to recommend a networking solution to meet the following requirement:
Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for the above requirement?

A hybrid tenant uses on-premises Active Directory and Microsoft Entra ID. Self-service password reset is required for a pilot group, including password writeback. Previous incidents were caused by an unhealthy writeback service even though SSPR was enabled.
Select TWO actions that together meet all requirements.

Contoso is migrating bespoke VMs into a scale set but needs per-instance control: attach existing NICs, pin some instances to specific zones, and scale in without disrupting protected instances. They still want to elastically add/remove instances as demand changes.
Requirements
– Attach existing NICs per instance
– Zone-aware placement control
– Instance-level protection during scale-in
Which option should you choose?

You’re creating a new archive container for compliance. Requirements:
Write-once, read-many (WORM) for 7 years (no edits or deletes).
Must still allow append-only log writes during the retention period (append blocks only).
Administrators manage via RBAC; no anonymous access.
How should you configure the container?

Contoso is building a public web tier in Australia East that must remain available during a complete zone outage. The design must use Azure-native components only.

Which deployment meets the requirements?

The ops team needs consistent time-bucketed insights across different log tables. Your goal is to standardize how they aggregate by time so dashboards don’t drift and everyone uses the same approach for hourly/daily rollups.
Requirements

The team needs one KQL pattern for consistent time bucketing across tables.
Which option should you choose?

You create a Recovery Services vault backup policy named Policy1 as shown in the following exhibit.

The backup date in the question is Sunday, March 1.
Based on the information provided, select the answer choice that completes the following statement correctly.
“The backup that occurs on Sunday, March 1, will be retained for ___________.”

You run two workloads:
A queue-driven worker that should scale from 0 to 50 based on backlog.
Bursty batch jobs that spin up dozens of short-lived containers in a VNet with no orchestrator. Keep idle cost near zero, avoid unnecessary complexity, and use native features where they fit.
Select TWO actions that together meet the goals.

Contoso uses a wildcard certificate stored in Azure Key Vault to secure many App Services across subscriptions.
They want central rotation in Key Vault and automatic sync to the apps when the certificate is renewed. The solution must keep bindings SNI-based and avoid manual re-uploads on every renewal.
Requirements
– Use wildcard cert from Key Vault
– Auto-sync to apps on renewal
– Keep SNI bindings
Which option should you choose?

You have an Azure subscription with VMs connected to VNet1. You plan to onboard the VMs to Azure Monitor VM Insights.
You must ensure all VM-to-Azure Monitor traffic goes privately via VNet1 only (no public endpoints).
What should you create first?

A Bicep file must add a new subnet to an existing virtual network. The VNet already exists in production and must not be recreated. You also want the subnet declared as a child resource of that VNet so name scoping is concise and validation is clear.
Requirements
– Treat the VNet as existing
– Add a new subnet as a child resource
– Keep the declaration minimal and safe
Which option should you choose?