[Jul 30, 2026] Get New AZ-104 Certification – Valid Exam Dumps Questions
100% Passing Guarantee - Brilliant AZ-104 Exam Questions PDF
NEW QUESTION # 149
You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in the following table.
You need to provide internet users with access to the applications that run in Cluster1.
Which IP address should you include in the DNS record for Ousted?
- A. 192.168.10.2
- B. 172.17.7.1
- C. 131.107.2.1
- D. 10.0.10.11
Answer: C
Explanation:
Explanation
When any internet user will try to access the cluster which is behind a load balancer, traffic will first hit to load balancer front end IP. So in the DNS configuration you have to provide the IP address of the load balancer.
Reference:
https://stackoverflow.com/questions/43660490/giving-a-dns-name-to-azure-load-balancer
NEW QUESTION # 150
You have two Azure subscriptions named Sub1 and Sub2. Sub1 is in a management group named MG1. Sub2 is in a management group named MG2. You have the resource groups shown in the following table.
You have the virtual machines shown in the following table.
Answer:
Explanation:
NEW QUESTION # 151
Your network contains an Active Directory domain named adatum.com and an Azure Active Directory (Azure AD) tenant named adatum.onmicrosoft.com.
Adatum.com contains the user accounts in the following table.
Adatum.onmicrosoft.com contains the user accounts in the following table.
You need to implement Azure AD Connect. The solution must follow the principle of least privilege.
Which user accounts should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 152
You have an Azure subscription that contains the Azure virtual machines shown in the following table.
You add inbound security rules to a network security group (NSG) named NSG1 as shown in the following table.
You run Azure Network Watcher as shown in the following exhibit.
You run Network Watcher again as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 153
You have an Azure subscription named Sub1.
You plan to deploy a multi-tiered application that will contain the tiers shown in the following table.
You need to recommend a networking solution to meet the following requirements:
* Ensure that communication between the web servers and the business logic tier spreads equally across the virtual machines.
* Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: an internal load balancer
Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines that reside inside a cloud service or a virtual network with a regional scope.
Box 2: an application gateway that uses the WAF tier
Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities.
References:
https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
NEW QUESTION # 154
You have an Azure subscription that contains the resources shown in the following table.
You need to load balance HTTPS connections to vm1 and vm2 by using Ib1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation:
https://learn.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-portal
NEW QUESTION # 155
You have an Azure subscription named Subscription1 that has a subscription ID of c276fc76-9cd4-44c9-99a7-
4fd71546436e.
You need to create a custom RBAC role named CR1 that meets the following requirements:
Can be assigned only to the resource groups in Subscription1
Prevents the management of the access permissions for the resource groups Allows the viewing, creating, modifying, and deleting of resource within the resource groups What should you specify in the assignable scopes and the permission elements of the definition of CR1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: " /subscription/c276fc76-9cd4-44c9-99a7-4fd71546436e "
In the assignableScopes you need to mention the subscription ID where you want to implement the RBAC Box 2: " Microsoft.Authorization/* " Microsoft.Authorization/* is used to Manage authorization
In Microsoft Azure Role-Based Access Control (RBAC), a custom role allows fine-grained permissions tailored to specific administrative needs. Custom RBAC roles are defined in JSON format and include three main elements - assignableScopes, permissions, and description.
1. Assignable Scopes
The assignable scope defines where the custom role can be applied.
In this scenario, the role must only be assignable to resource groups in the given subscription (not at the subscription or tenant root level).
Therefore, the assignable scope should be limited to the resource groups path:
" /subscriptions/c276fc76-9cd4-44c9-99a7-4fd71546436e/resourceGroups "
This ensures that the role can be assigned only within resource groups in the specified subscription, not globally.
2. Permissions
The permissions section includes four arrays:
actions # defines allowed operations.
notActions # explicitly denies specific operations.
dataActions and notDataActions # for data-plane access (not needed here).
Because the requirement states that the user should be able to view, create, modify, and delete resources within the resource groups, the actions array should contain:
" actions " : [ " * " ]
This grants full control over resource operations.
However, the question also specifies that the role must prevent the management of access permissions for the resource groups.
Managing access permissions is controlled by Microsoft.Authorization/ actions (e.g., Microsoft.Authorization
/*/Write).
Thus, to explicitly block the ability to manage permissions, the notActions array must include:
" notActions " : [
" Microsoft.Authorization/* "
]
This restriction ensures that users with this role cannot assign roles, modify access control (RBAC), or change role assignments, even though they have full resource management permissions otherwise.
3. Summary of Correct JSON Configuration
{
" Name " : " CR1 " ,
" Description " : " Custom role to manage resources within resource groups but not RBAC permissions " ,
" AssignableScopes " : [
" /subscriptions/c276fc76-9cd4-44c9-99a7-4fd71546436e/resourceGroups "
],
" Permissions " : [
{
" Actions " : [
" * "
],
" NotActions " : [
" Microsoft.Authorization/* "
],
" DataActions " : [],
" NotDataActions " : []
}
]
}
4. Validation with Azure Administrator Study Guide
This configuration directly aligns with guidance in Microsoft Learn: "Azure custom roles in Azure RBAC" and AZ-104 Study Guide Module: Manage role-based access control (RBAC).
It meets all requirements:
Restricts role assignment scope to resource groups only.
Allows full resource management (CRUD).
Denies RBAC access control modifications via Microsoft.Authorization/*.
Final Verified Answers:
# Assignable Scope: /subscriptions/c276fc76-9cd4-44c9-99a7-4fd71546436e/resourceGroups
# Permission (notActions): " Microsoft.Authorization/* "
NEW QUESTION # 156
You purchase a new Azure subscription named Subscription1.
You create a virtual machine named VM1 in Subscription1. VM1 is not protected by Azure Backup.
You need to protect VM1 by using Azure Backup. Backups must be created at 01:00 and stored for 30 days.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Box 1: A Recovery Services vault
A Recovery Services vault is an entity that stores all the backups and recovery points you create over time.
Box 2: A backup policy
What happens when I change my backup policy?
When a new policy is applied, schedule and retention of the new policy is followed.
References:
https://docs.microsoft.com/en-us/azure/backup/backup-configure-vault
https://docs.microsoft.com/en-us/azure/backup/backup-azure-backup-faq
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or configuration information for virtual machines (VMs), workloads, servers, or workstations. You can use Recovery Services vaults to hold backup data for various Azure services such as IaaS VMs (Linux or Windows) and Azure SQL databases.
You can use backup policy to configure schedule.
https://docs.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overviewhttps://docs.micro
NEW QUESTION # 157
You sign up for Azure Active Directory (Azure AD) Premium.
You need to add a user named [email protected] as an administrator on all the computers that will be joined to the Azure AD domain.
What should you configure in Azure AD?
- A. Providers from the MFA Server blade.
- B. Device settings from the Devices blade.
- C. General settings from the Groups blade.
- D. User settings from the Users blade.
Answer: B
Explanation:
When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principles to the local administrators group on the device:
The Azure AD global administrator role
The Azure AD device administrator role
The user performing the Azure AD join
In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices page:
1. Sign in to your Azure portal as a global administrator or device administrator.
2. On the left navbar, click Azure Active Directory.
3. In the Manage section, click Devices.
4. On the Devices page, click Device settings.
5. To modify the device administrator role, configure Additional local administrators on Azure AD joined devices.
NEW QUESTION # 158
You have an Azure subscription named Subscription1.
In Subscription1, you create an Azure file share named share1.
You create a shared access signature (SAS) named SAS1 as shown in the following exhibit.
To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Will be prompted for credentials
Azure Storage Explorer is a standalone app that enables you to easily work with Azure Storage data on Windows, macOS, and Linux. It is used for connecting to and managing your Azure storage accounts.
Box 2: Will have read, write, and list access
The net use command is used to connect to file shares.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1
https://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-explorer?tabs=windows
NEW QUESTION # 159
You have an Azure subscription that contains a storage account named account1.
You plan to upload the disk files of a virtual machine to account! from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24.
You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
You need to configure account1 to meet the following requirements:
* Ensure that you can upload the disk files to account1.
* Ensure that you can attach the disks to VM1.
* Prevent all other access to account1.
Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.
- A. From the Networking blade of account1. select Allow trusted Microsoft services to access this storage account
- B. From the Networking blade of account1, select Selected networks
- C. From the Networking blade of account1, add VNet1.
- D. From the Networking blade of account11, add the 131.107.1.0/24 IP address range.
- E. From the Service endpoints blade of VNet1, add a service endpoint.
Answer: B,C
Explanation:
To restrict access to account1, you need to enable the firewall and virtual network settings on the storage account. This allows you to specify which networks can access the storage account. By selecting Selected networks, you can block all access from the public internet and only allow access from the specified networks.
By adding VNet1, you can allow access from the virtual network that contains VM1. You do not need to add the on-premises IP address range or enable the service endpoint option, as these are not required for uploading the disk files to the storage account. You do not need to allow trusted Microsoft services, as this is not relevant for the scenario. Then, References: [Configure Azure Storage firewalls and virtual networks] [Upload a generalized VHD to Azure]
NEW QUESTION # 160
You have an Azure subscription named Sub1 that contains two users named User1 and User2.
You need to assign role-based access control (RBAC) roles to User1 and User2. The users must be able to perform the following tasks in Sub1:
* User1 must view the data in any storage account.
* User2 must assign users the Contributor role for storage accounts.
The solution must use the principle of least privilege.
Which RBAC role should you assign to each user? To answer, drag the appropriate roles to the correct users.
Each role may be used once, more than once, or not at all.
Answer:
Explanation:
* User1: You should assign the Reader and Data Access role to User1. This role grants read access to Azure resources and data, including the data in any storage account1. This role is suitable for User1's task of viewing the data in any storage account, and it follows the principle of least privilege by not granting any write or delete permissions.
* User2: You should assign the Storage Account Contributor role to User2. This role grants full access to manage storage accounts and their data, including the ability to assign roles in Azure RBAC2. This role is suitable for User2's task of assigning users the Contributor role for storage accounts, and it follows the principle of least privilege by not granting access to other types of resources.
NEW QUESTION # 161
You manage two Azure subscriptions named Subscription1 and Subscription2.
Subscription1 has the following virtual networks:
The virtual networks contain the following subnets:
Subscription2 contains the following virtual network:
* Name: VNETA
* Address space: 10.10.128.0/17
* Location: Canada Central
VNETA contains the following subnets:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Box 1: Yes
With VNet-to-VNet you can connect Virtual Networks in Azure across Different regions.
Box 2: Yes
Azure supports the following types of peering:
Virtual network peering: Connect virtual networks within the same Azure region.
Global virtual network peering: Connecting virtual networks across Azure regions.
Box 3: No
The virtual networks you peer must have non-overlapping IP address spaces.
References:
https://azure.microsoft.com/en-us/blog/vnet-to-vnet-connecting-virtual-networks-in-azure-across-different-region
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-const
NEW QUESTION # 162
You have Azure subscriptions named Subscription1 and Subscription2.
Subscription1 has following resource groups:
RG1 includes a web app named App1 in the West Europe location.
Subscription2 contains the following resource groups:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-limitations/app-service-move-limitations
NEW QUESTION # 163
You have an Azure AD tenant that is linked to the subscriptions shown in the following table.
You have the resource groups shown In the following table.
You assign roles to users as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
User1 can resize VM1. Yes, this is correct. According to the tables, User1 is assigned the Contributor role at the subscription level for Sub1. The Contributor role grants full access to manage all resources in the subscription, including the ability to resize virtual machines1. Therefore, User1 can resize VM1, which is a resource in RG1 under Sub1.
User2 can create a new storage account in RG1. No, this is not correct. According to the tables, User2 is assigned the Reader role at the resource group level for RG1. The Reader role grants read-only access to view existing resources in the resource group, but not to create, update, or delete any resources2.
Therefore, User2 cannot create a new storage account in RG1.
User3 can assign User1 the Owner role for RG3. No, this is not correct. According to the tables, User3 is assigned the Storage Account Contributor role at the resource group level for RG3. The Storage Account Contributor role grants full access to manage storage accounts and their data in the resource group, but not to assign roles to other users3. To assign roles to other users, User3 would need a role that has Microsoft.Authorization/roleAssignments/write permissions, such as User Access Administrator or Owner4. Therefore, User3 cannot assign User1 the Owner role for RG3.
NEW QUESTION # 164
You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table.
Adatum.com has the following configurations:
Users may join devices to Azure AD is set to User1.
Additional local administrators on Azure AD joined devices is set to None.
You deploy Windows 10 to a computer named Computer. User1 joins Computer1 to adatum.com.
You need to identify which users are added to the local Administrators group on Computer1.
- A. User1 and User2 only
- B. User2 only
- C. User1 only
- D. User1, User2, User3, and User4
- E. User1, User2, and User3 only
Answer: A
Explanation:
Explanation
Users may join devices to Azure AD - This setting enables you to select the users who can register their devices as Azure AD joined devices. The default is All.
Additional local administrators on Azure AD joined devices - You can select the users that are granted local administrator rights on a device. Users added here are added to the Device Administrators role in Azure AD.
Global administrators, here User2, in Azure AD and device owners are granted local administrator rights by default.
References:
https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal
NEW QUESTION # 165
You have the App Service plans shown in the following table.
You plan to create the Azure web apps shown in the following table.
You need to identify which App Service plans can be used for the web apps.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: ASP1 ASP3
Asp1, ASP3: ASP.NET Core apps can be hosted both on Windows or Linux.
Not ASP2: The region in which your app runs is the region of the App Service plan it's in.
Box 2: ASP1
ASP.NET apps can be hosted on Windows only.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=platform-linux
https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage#
NEW QUESTION # 166
You have an Azure subscription that contains a virtual network named VNet1 and a virtual machine named VM1. VM1 runs Windows Server and is connected to VNet1.
You perform the following tasks:
- On VM1, you install the DNS Server role.
- On VM1, you create a standard primary DNS zone named zone1.com.
- From the Azure portal, you create an Azure DNS zone named zone2.com.
- From the Azure portal, you create an Azure Private DNS zone named
zone3.com.
For which zones can you add a virtual network link to VNet1?
- A. zone1.com, zone2.com, and zone3.com
- B. zone3.com only
- C. zone2.com and zone3.com only
- D. zone1.com only
- E. zone2.com only
Answer: B
Explanation:
* zone3.com - Yes
In Azure, the Virtual Network Link feature is exclusively used for Azure Private DNS zones. It allows resources within a specific virtual network to resolve domain names defined in that private zone and, if configured, automatically register their own DNS records.
zone3.com is an Azure Private DNS zone, which is the only type of zone in this scenario that supports and requires a virtual network link for internal name resolution.
Reference:
https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal
NEW QUESTION # 167
You have an Azure subscription that contains an Azure Storage account named storage1 and the users shown in the following table.
You plan to monitor storage1 and to configure email notifications for the signals shown in the following table.
You need to identify the minimum number of alert rules and action groups required for the planned monitoring.
How many alert rules and action groups should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups
NEW QUESTION # 168
You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual machines.
You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text.
What should you create to store the password?
- A. a Recovery Services vault and a backup policy
- B. an Azure Key Vault and an access policy
- C. Azure Active Directory (AD) Identity Protection and an Azure policy
- D. an Azure Storage account and an access policy
Answer: D
Explanation:
You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is stored in a Key Vault. Therefore the password is never put in plain text in the template parameter file.
NEW QUESTION # 169
You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com contains the groups in the following table.
You create two user accounts that are configured as shown in the following table.
To which groups do User1 and User2 belong? To answer. select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Group 1 only
First rule applies
Box 2: Group1 and Group2 only
Both membership rules apply.
References: https://docs.microsoft.com/en-us/sccm/core/clients/manage/collections/create-collections
NEW QUESTION # 170
You have a hybrid deployment of Azure AD that contains the users shown in the following table.
You need to modify the JobTitle and UsageLocation attributes for the users.
For which users can you modify the attributes from Azure AD? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal
NEW QUESTION # 171
......
What is Microsoft AZ-104 Exam
The Microsoft az-104 certification exam, also known as the Microsoft Certified Solutions Associate (MCSA): Microsoft Azure Solutions Architect Certification is a test provided by Microsoft for IT professionals. The test measures how well you understand Azure technologies and includes both technical and behavioral questions. Implementing some of the more basic Microsoft Azure technology solutions is another focus of this exam. You can take the test on any computer, either at home or on your mobile device. However, it is best to take this test in a quiet place with no distractions. Employers are always looking for certified professionals. Credential holders are able to expand their knowledge, expand their skillset, and increase their marketability. Solid test takers are able to move into leadership roles with larger organizations.
Fundamental knowledge of cloud computing and its many functions will give you an advantage on the exam. Aspects of Azure are covered in-depth, but you should also be familiar with other cloud computing technologies as well. Affiliate marketing, SEO, and websites are common areas of focus. Microsoft AZ-104 exam dumps also include each of the objectives covered, which you may find useful. Servicecreate and Serviceupdate and project and security and identity and storage and messaging and rendering all require knowledge of these technologies. Country and regional settings for all of these Azure regions are also covered. Units of measurement are also an important piece of this exam.
Free AZ-104 braindumps download: https://www.torrentvce.com/AZ-104-valid-vce-collection.html
AZ-104 Dumps 2026 - NewMicrosoft Exam Questions: https://drive.google.com/open?id=1zokJgOJe5jMZnrV6uuLztnUoyc853mW_