Free Microsoft Azure AZ-104 Actual Exam Questions

C, since it grants deployment rights via Azure AD, fitting least privilege perfectly.

Option C makes sense since Website Contributor grants deployment rights with Azure AD and limits access. Owner is overkill, and FTP credentials don’t integrate with Azure AD for Web Deploy.

You can’t see the ARM template from the VM blade itself since deployment details are linked to resource groups. Shouldn’t we check the deployment history in the resource group instead to find that template?

Looking at the VM blade alone won’t show the ARM template because deployment info is tied to resource group or subscription level. So this doesn’t meet the goal, so B.

B imo, because New-AzureADMSInvitation sends invites, not just creates accounts quietly.

Option A sounds right, but does the question expect just guest accounts or actual invitations sent? Because New-AzureADMSInvitation sends invites, not just creates accounts silently.

I think step one should be to create the tags for each department on the resources since the question implies we need to report by department. Without tagging, cost analysis wouldn't split properly.

Start with tagging resources for each department, then create a cost management view, finally generate the report.

B. Kubenet uses NAT, so pods aren’t directly reachable by on-prem IPs. Azure CNI assigns pod IPs from the VNet, making them accessible if the network is connected properly.

It’s A because kubenet uses NAT, so pod IPs aren’t directly reachable from on-prem. Since they need direct pod IP access, kubenet won’t work, leaving Azure CNI as the only fit.

B redeploy might reset the VM but doesn’t guarantee a host switch right away.

D imo, redeploy mainly refreshes the VM but doesn’t promise a different host immediately. For guaranteed host change, you usually need to stop/start the VM or use live migration features.

D is simpler than A because peering handles routing automatically without manual routes.

If VM1 and VM4 are on different VNets, user-defined routes (A) could get complicated to manage compared to peering. Assigning a new IP (C) feels like it might not solve cross-VNet communication by itself. Could the IP ranges already overlap?

I’d say you should start by creating the Storage Sync Service because that’s the main resource managing sync. Next, install the Azure File Sync agent on Server1 so the server can communicate with Azure. Finally, register Server1 with the Storage Sync Service to link it up and begin syncing files. This order makes sense since you need the service in place before the server can register and sync properly.

I’m thinking you need to create the Storage Sync Service first. Without that, you can’t register the server or create the sync group. So after creating the Storage Sync Service, you register Server1 with it, then create the sync group that includes your Azure file share. Installing the Azure File Sync agent on Server1 happens early too, but registering is tied to having the service set up. This order makes sure everything’s linked properly before syncing starts.

B. Using a storage account as the source for alerts on event logs doesn’t really work here. The Microsoft Monitoring Agent sends data to a Log Analytics workspace, not directly to a storage account. Without setting up Log Analytics, you can’t create the alert based on those system events. So this setup misses that key part.

Option B, storage accounts don’t trigger alerts from event logs directly.

I agree on 3 alert rules for the 3 signals. Since action groups can have multiple email recipients, just one group should handle all notifications without any issue. No need to overcomplicate.

3 alert rules, 1 action group since emails can be combined in one group.

You can also think of it like preparing a recipe (import/create), cooking it up (compile), then serving it to the guests (assign). Skipping compile means the VMs won’t have a usable configuration.

Assigning the configuration comes last after compiling and importing.

Policy1 can be assigned up to resource group level; exclusions can be at resource group or subscription level.

Policy assignments can't target individual resources, so Policy1 should be assigned at management group, subscription, or resource group levels. Exclusions, though, can be specified at the resource level within those scopes.

Guessing D too, since none of the other options handle keys directly. Backup vaults and recovery services are for data protection, not keys, and lifecycle management is about data lifecycle, not security.

It’s D because Azure Key Vault is designed to handle secrets and key rotation, unlike lifecycle management which focuses on data retention policies, not security keys.

Creating the Storage Sync Service is definitely a must for subscription prep.

I think the key here is focusing on what “preparing the subscription” really means. Creating the Storage Sync Service is definitely needed because it acts as the backbone for syncing. Registering Server1 with that service also makes sense since you need to link the on-prem server. Creating a sync group feels like the next logical step, but maybe that’s more about configuring sync rather than preparing the subscription itself. So, I’d say the two main actions to prepare are creating the Storage Sync Service and registering Server1. The sync group probably comes after you’ve set those up.

G first to set up health checks, then C for frontend IP, and finally D for load balancing rule.

I'd start with creating the health probe (G) to monitor VM health, then assign the frontend IP (C) so lb1 has an endpoint, and finally create the load balancing rule (D) to route HTTPS traffic properly.