10 free Microsoft AZ-104 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 606 questions. Work through them, then open each answer to check your reasoning.
Get all 606 questions (US$39) · Download these 10 as a PDF
Question 1
Your company has several departments. Each department has a number of virtual machines (VMs).
The company has an Azure subscription that contains a resource group named RG1.
All VMs are located in RG1.
You want to associate each VM with its respective department.
What should you do?
Show answer and explanation
Correct answer: C. Assign tags to the virtual machines.
Tags are the appropriate mechanism for associating metadata with Azure resources like VMs without restructuring the resource hierarchy. Since all VMs are already in RG1 and the company wants to maintain this structure while simply identifying which department owns each VM, tags provide a lightweight, flexible solution. Tags allow for arbitrary ke-alue pairs that enable categorization, billing tracking, and automation without moving resources between groups.
Why the other options are wrong
- A. Management Groups are for managing policies and access across multiple subscriptions and resource groups, not for organizing VMs within a single resource group by department.
- B. Creating a resource group per department would fragment the existing RG1 structure and contradict the stated requirement that all VMs are located in RG1.
- D. Modifying VM settings does not provide a systematic way to track and organize VMs by department for reporting or billing purposes.
Question 2
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company has an Azure Active Directory (Azure AD) subscription.
You want to implement an Azure AD conditional access policy.
The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.
Solution: You access the multi-factor authentication page to alter the user settings.
Does the solution meet the goal?
Show answer and explanation
Correct answer: B. No
Altering user settings on the multi-factor authentication page configures MFA authentication methods but does not create or configure a conditional access policy. Conditional access policies are specifically configured in Azure AD under the Conditional Access blade, not through the MFA user settings page. The solution addresses only MFA enablement, not the policy requirements for device compliance and location-based restrictions.
Why the other options are wrong
- A. The MFA settings page is insufficient for implementing conditional access policies, which require explicit policy configuration in the Conditional Access section of Azure AD.
Question 3
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company has an Azure Active Directory (Azure AD) subscription.
You want to implement an Azure AD conditional access policy.
The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.
Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.
Does the solution meet the goal?
Show answer and explanation
Correct answer: B. No
Session controls in conditional access policies manage ongoing session behavior (such as sign-in frequency and browser session lifetime) but do not enforce MFA or device compliance requirements. Session controls are insufficient to meet the requirement of mandating MFA and Azure AD-joined devices. Grant controls are the correct setting for requiring MFA and device compliance checks during access.
Why the other options are wrong
- A. Session controls do not enforce authentication method or device requirements; they only manage active session characteristics after initial access decisions are made.
Question 4
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company has an Azure Active Directory (Azure AD) subscription.
You want to implement an Azure AD conditional access policy.
The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.
Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy.
Does the solution meet the goal?
Show answer and explanation
Correct answer: A. Yes
Grant controls in conditional access policies are exactly where MFA and device compliance requirements are configured. By accessing the Azure portal and modifying the grant control settings, an administrator can require that Global Administrators must satisfy both MFA and Azure AD-joined device conditions when accessing from untrusted locations. This directly addresses all stated requirements.
Why the other options are wrong
- B. Grant controls are the proper mechanism for enforcing authentication and device requirements in conditional access policies.
Question 5
You are planning to deploy an Ubuntu Server virtual machine to your company's Azure subscription.
You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA).
Which of the following should you use to create the virtual machine?
Show answer and explanation
Correct answer: B. The New-AzVM cmdlet.
New-AzVM is the current Azure PowerShell cmdlet for creating virtual machines, and it supports custom deployment settings, including adding a particular trusted root certification authority to the VM configuration. It belongs to the Az module, which replaced the older AzureRM module, so it is the supported choice for this custom Ubuntu Server deployment.
Why the other options are wrong
- A. New-AzureRmVm is from the retired AzureRM module and is no longer supported for new deployments.
- C. Create-AzVM is not a valid Azure PowerShell cmdlet.
- D. az vm create is an Azure CLI command, not the PowerShell cmdlet required here.
Question 6
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.
After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.
To achieve this, the Per Enabled User setting must be set for the usage model.
Solution: You reconfigure the existing usage model via the Azure portal.
Does the solution meet the goal?
Show answer and explanation
Correct answer: B. No
The usage model for an existing Multi-Factor Authentication provider cannot be changed once it has been created and configured. The Per Authentication and Per Enabled User settings are selected at the time of MFA provider creation and are immutable through the Azure portal or any other method. To switch usage models, a new MFA provider must be created with the desired setting.
Why the other options are wrong
- A. Usage models cannot be reconfigured on existing MFA providers; they are set during creation and cannot be modified afterward.
Question 7
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.
After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.
To achieve this, the Per Enabled User setting must be set for the usage model.
Solution: You reconfigure the existing usage model via the Azure CLI.
Does the solution meet the goal?
Show answer and explanation
Correct answer: B. No
Similar to Question 6, the usage model for Multi-Factor Authentication cannot be reconfigured after the provider is created, regardless of whether the attempt is made via the Azure portal or Azure CLI. The usage model is a fundamental property set at creation time and is immutable. CLI commands do not provide the capability to alter this configuration.
Why the other options are wrong
- A. Azure CLI does not provide the ability to change an MFA provider's usage model; this is a fixed property from creation.
Question 8
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.
After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.
To achieve this, the Per Enabled User setting must be set for the usage model.
Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data.
Does the solution meet the goal?
Show answer and explanation
Correct answer: A. Yes
A provider's usage model is fixed at creation time, so the supported way to move to Per Enabled User is to create a new Multi-Factor Authentication provider with that usage model and restore a backup of the existing provider's data into it. This carries the existing configuration and users across while applying the required setting, so the solution meets the goal.
Why the other options are wrong
- B. Creating a new provider with the required usage model and restoring the backed up provider data is the documented migration path, so the goal is achieved.
Question 9
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain.
You have a server named DirSync1 that is configured as a DirSync server.
You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.
Solution: You run the Start-ADSyncSyncCycle -PolicyType Initial PowerShell cmdlet.
Does the solution meet the goal?
Show answer and explanation
Correct answer: A. Yes
Start-ADSyncSyncCycle triggers a synchronization cycle on demand instead of waiting for the scheduled one. Run with -PolicyType Initial it performs a full sync that processes all objects, including the newly created user account, so the new user is replicated to Azure AD immediately. This satisfies the requirement.
Why the other options are wrong
- B. A full sync cycle processes every object, including new accounts, so the new user is replicated to Azure AD right away.
Question 10
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
Establish if the solution satisfies the requirements.
Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain.
You have a server named DirSync1 that is configured as a DirSync server.
You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.
Solution: You use Active Directory Sites and Services to force replication of the Global Catalog on a domain controller.
Does the solution meet the goal?
Show answer and explanation
Correct answer: B. No
Using Active Directory Sites and Services to force replication of the Global Catalog on a domain controller only replicates data within the on-premises Active Directory environment. It does not trigger synchronization from on-premises AD to Azure AD. The DirSync/Azure AD Connect service is a separate synchronization mechanism that has its own schedule and must be triggered separately to replicate objects to Azure AD.
Why the other options are wrong
- A. Active Directory Sites and Services only handles on-premises AD replication, not Azure AD synchronization.
That was 10 of 606.
The full Microsoft AZ-104 pack has all 606 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.