Skip to main content
Use code minus20 for a $20 discount at checkout!
🛒 0 Login / Register

AZ-104 sample questions

5 questions from the AZ-104 question set, which has 479 in total. Try each one before opening the answer.

Question 1 Multiple answer Mix Questions
Case study Mix QuestionsAZ-104 Mix Questions IN THIS CASE STUDY

This section contains standalone questions (no shared case-study scenario) covering all five AZ-104 exam domains: identity and governance, storage, compute, networking, and monitoring/backup. Every question has been independently verified against current Microsoft Learn documentation.

You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image.

You need to ensure that when the scale set virtual machines are provisioned, they have web server components installed.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE Each correct selection is worth one point.

  1. Modify the extensionProfile section of the Azure Resource Manager template.

  2. Create a new virtual machine scale set in the Azure portal.

  3. Create an Azure policy.

  4. Create an automation account.

  5. Upload a configuration script.

Show answer

Answer: A, E

Explanation

Installing web server components (e.g., IIS) automatically at provisioning time on scale set VMs is done through a VM extension — typically the Custom Script Extension — declared in the scale set's ARM template extensionProfile section (option A). That extension must reference an actual script (e.g., a PowerShell script) that performs the installation, which needs to be uploaded somewhere accessible, such as a storage account blob (option E); the extensionProfile then points to that script's URI. Creating the scale set manually in the Azure portal (B) contradicts the stated goal of automating the deployment and provides no mechanism to run installation logic. An Azure Policy (C) enforces/audits configuration compliance but does not install software, and an automation account/runbook (D) is not wired into VMSS instance provisioning by default. The correct pairing is A and E.

Official Reference

Custom Script Extension for Windows — https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows

Question 2 Hotspot Mix Questions

You need to generate a shared access signature (SAS). The solution must meet the following requirements:

• Ensure that the SAS can only be used to enumerate and download blobs stored in container1.

• Use the principle of least privilege,

Which three settings should you enable? To answer, select the appropriate settings in the answer area.

NOTE: Each correct selection is worth one point.

Exhibit
Show answer
Answer
Question 3 Single answer Mix Questions

You have an Azure subscription named Subscription1 that is used be several departments at your company. Subscription1 contains the resources in the following table:

Another administrator deploys a virtual machine named VM1 and an Azure Storage account named Storage2 by using a single Azure Resource Manager template.

You need to view the template used for the deployment.

From which blade can you view the template that was used for the deployment?

Exhibit

  1. RG1

  2. VM1

  3. Storage1

  4. Container1

Show answer

Answer: A

Explanation

Azure Resource Manager records deployment history at the resource-group scope: every template-based deployment made into a resource group appears under that resource group's 'Deployments' blade, which lets you view (and re-download) the exact template and parameters used for the deployment, along with its status. Since VM1 and Storage2 were deployed together via a single ARM template into a resource group (RG1 in this scenario), the 'Deployments' blade under RG1 is where the administrator can view that template. Individual resource blades like VM1 or Storage1 do not expose the original deployment template (a resource's 'Export template' feature only generates a template reflecting its CURRENT state, not the historical template actually used), and Container1 is a blob-storage sub-resource with no deployment-history feature at all.

Official Reference

View deployment history with Azure Resource Manager — https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-history

Question 4 Single answer Mix Questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft Entra tenant named Adatum.com and an Azure Subscription named Subscription1. Adatum.com contains a group named Developers. Subscription1 contains a resource group named Dev.

You need to provide the Developers group with the ability to create Azure Logic Apps in the Dev resource group.

Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group.

Does this meet the goal?

  1. Yes

  2. No

Show answer

Answer: B

Explanation

The built-in DevTest Labs User role grants permissions scoped narrowly to working within an existing Azure DevTest Labs lab (creating/managing VMs and environments inside a lab, claiming lab VMs, etc.) - it grants no rights over Microsoft.Logic/workflows (Logic Apps) and does not include general resource-group-level Contributor-style create permissions. Assigning it at the subscription (or even the Dev resource group) scope does not grant the Developers group the Microsoft.Logic/workflows/write action needed to create Logic Apps in the Dev resource group. The correct approach would be assigning a role such as Contributor or Logic App Contributor scoped to the Dev resource group. Because DevTest Labs User does not confer Logic App creation rights, this solution does not meet the goal, so the answer is No.

Official Reference

Azure built-in roles reference — https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Question 5 Drag and drop Mix Questions

You have an Azure subscription named Subscription1.

You create an Azure Storage account named contosostorage, and then you create a file share named data.

Which UNC path should you include in a script that references files from the data file share? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

NOTE: Each correct selection is worth one point.

Exhibit
Show answer
Answer

Back to AZ-104 formats and access options →

Scroll to Top