AZ 104 Sample Questions and Explanations

These az 104 sample questions match the real exam's scenario style: a short situation, four options, one answer, and an explanation of the strongest wrong answer. Objectives are on the exam objectives page.

Question 1 (Networking)

An airline's reservation service uses an Azure NAT gateway for outbound traffic. The service will open up to 70,000 concurrent connections to the same partner API endpoint. The partner firewall can accept at most two allowlist entries, and each entry must be a single public IPv4 address; CIDR ranges are not supported. You must avoid SNAT port exhaustion. How should you configure the public IP addresses on the NAT gateway?

• A. One Standard public IP with a 30-minute idle timeout.
• B. Two Standard public IPs on the NAT gateway.
• C. One Standard public IP on the NAT gateway.
• D. A /28 Standard public IP prefix on the NAT gateway.

Answer: B

This is correct because a single Standard public IP provides 64,000 SNAT ports, so 70,000 simultaneous connections to one endpoint exceed that per-IP ceiling. Two Standard public IPs provide 128,000 SNAT ports and fit the partner's two-entry allowlist. The /28 prefix would provide enough ports, but it is a CIDR range containing 16 addresses; because the firewall accepts only individual IP addresses, it fails the allowlist constraint. Changing the idle timeout does not raise the 64,000-port ceiling; it only controls how long idle connections are held. The general rule is that NAT gateway outbound capacity scales by 64,000 SNAT ports per attached public IP, so choose the number of public IPs based on concurrent connections, not on idle timeout alone.

Question 2 (Networking)

Contoso Airlines has a production spoke virtual network that already contains 400 private endpoints, the maximum allowed in one VNet. After an acquisition, the application team needs 25 more private endpoint connections to Azure PaaS from that same spoke. The subscription's regional Private Endpoint quota has been increased and is not the constraint. All traffic must remain on private IP addresses. How should you provide the new private endpoints while minimizing overhead?

• A. Expose the new services through an Azure Private Link service from the existing production spoke.
• B. Deploy the endpoints in a new peered VNet with the existing private DNS zones linked.
• C. Add a dedicated private endpoint subnet to the existing spoke and deploy the endpoints there.
• D. Use Azure service endpoints for the new services while keeping the existing private endpoints in place.

Answer: B

This is correct because the limit that applies is per virtual network: a VNet can contain at most 400 private endpoints, so the 25 additional endpoints cannot be placed anywhere inside the existing spoke. Putting them in a second VNet, peering that VNet to the spoke, and linking the existing private DNS zones to it gives the application private IP connectivity and name resolution. The strongest distractor is the dedicated private endpoint subnet option; a dedicated subnet is a normal private endpoint design, but adding a subnet does not raise the per-VNet endpoint count. A Private Link service exposes your own workload rather than consuming PaaS, and service endpoints do not provide private IP addresses. General rule: identify the quota scope before choosing a fix; when the per-VNet private endpoint quota is exhausted, scale by adding a peered VNet rather than another subnet.

Question 3 (Networking)

A gaming studio's production virtual network contains 120 VMs. The subscription private endpoint quota already allows more than 80 endpoints. The VMs must access 80 different Azure PaaS resources, and each resource must be reachable through a private endpoint. All traffic must stay on the Microsoft backbone. You need to design the private endpoint deployment. What should you do?

• A. Use service endpoints for all PaaS resources, and use private endpoints only for resources without service endpoint support.
• B. Open a support request to increase the private endpoint quota for the production virtual network before creating all 80 endpoints.
• C. Create one private endpoint for each of the 80 PaaS resources in a dedicated subnet of the existing production virtual network.
• D. Create 40 endpoints in the production VNet and 40 in a new peered VNet; link the private DNS zones to both VNets.

Answer: D

Splitting the endpoints across two peered VNets is correct because Azure allows a maximum of 64 private endpoints per virtual network; 40 in each VNet stays under that ceiling, and VNet peering keeps the 120 VMs connected to the endpoint IPs. The strongest distractor is the single-VNet option: it looks like the simplest direct design, but 80 endpoint resources exceed the fixed per-VNet limit. A support request cannot raise that VNet limit, and service endpoints do not meet the explicit private-endpoint requirement. The general rule is to treat 64 private endpoints per VNet as a hard boundary; if you need more, spread the endpoints across peered VNets and link the private DNS zones to every VNet.

Question 4 (Networking)

Your gaming studio is deploying 15 new game server VMs in East US. Each VM must be reachable over the internet on a dedicated public IP address, and the studio wants all servers in East US to keep latency low. The East US subscription already uses 8 of its 10-address Standard public IP quota. You need to give the new VMs public connectivity while meeting the dedicated-IP and region requirements. What should you do?

• A. Request a quota increase for Standard public IP addresses in East US, then create the 15 new public IP addresses.
• B. Create a Standard load balancer with one public IP frontend and put all 15 game servers in its backend pool.
• C. Create a public IP prefix in East US and assign public IP addresses from the prefix to the 15 new game server VMs.
• D. Deploy the 15 game server VMs in a different Azure region and assign each VM a public IP address there.

Answer: A

This is correct because the scenario turns on a hard quota boundary: 15 more dedicated Standard public IPs are needed in East US, but only 2 of the current 10-address quota are unused. A quota increase is the only option that satisfies both the dedicated-IP and East US requirements. The strongest distractor is the load balancer answer; it is a normal, cost-efficient way to front multiple VMs with one public IP, but it gives the VMs a shared frontend IP, not a dedicated public IP per VM. The public IP prefix option is also tempting but fails because a prefix reserves addresses that still count toward the public IP address quota, so it does not avoid the limit. The rule that generalises: when a requirement genuinely consumes a quota-limited resource, identify the quota as the governing constraint and raise it; do not substitute an architecture that changes the requirement.

Question 5 (Compute)

Your airline's booking portal is one App Service app and must present 120 partner-specific, non-wildcard TLS certificates, one per partner. The PFX files are already in your possession, and each partner contract forbids combining them. TLS must terminate on the App Service app itself. The Premium v3 plan has unused capacity and no subscription certificate quota has been reached. How should you configure the certificates?

• A. Place Azure Application Gateway in front and terminate TLS there with all 120 certificates, sending HTTP to App Service.
• B. Upload all 120 certificates to the existing app; the limit is per subscription, and no subscription quota has been reached.
• C. Create additional App Service apps in the same plan and spread certificates across them so no single app passes its per-app certificate limit.
• D. Add more instances to the Premium v3 plan, because the certificate limit scales with the number of plan instances.

Answer: C

This is correct because the governing limit for App Service certificates and TLS bindings is per App Service app, not per App Service plan or per subscription. A subscription-wide quota is an aggregate limit and does not increase the per-app ceiling, so putting all 120 certificates on the existing app fails even though the subscription quota is not exhausted. Scaling the plan adds compute capacity, not certificate capacity. The Application Gateway option would move TLS termination off App Service, which the scenario explicitly forbids. The general rule: separate aggregate quotas from per-resource ceilings; for App Service certificates, the ceiling is per app.

Question 6 (Monitoring)

Your airline has 120 Azure VMs running flight-operations databases. A compliance mandate requires each database to have an independent backup schedule and independent retention settings, so you need one Azure Backup policy per database. All VMs reside in a single subscription and region. You have no existing Recovery Services vault. What should you do to meet the requirement while minimizing administrative overhead?

• A. Create 120 Recovery Services vaults and place one policy in each vault.
• B. Create one Recovery Services vault and add 120 backup policies to it.
• C. Create two Recovery Services vaults and split the 120 policies between them.
• D. Create one Recovery Services vault and apply one policy to all 120 databases.

Answer: C

Each Recovery Services vault has a documented limit of 100 Azure Backup policies. Because the airline needs 120 independent policies, a single vault cannot satisfy the requirement. Splitting the policies across two Recovery Services vaults keeps each vault under the limit and is the least-overhead design. The single-vault option is the strongest distractor: it would be the obvious minimal choice, but it exceeds the vault's policy quota. The single-policy option fails because a shared policy cannot give each database an independent schedule and retention. The 120-vault option is not a reasonable least-overhead design. General rule: always check per-vault backup limits, such as policy count and protected-item count, and use additional Recovery Services vaults when a workload exceeds those limits.

Question 7 (Monitoring)

A public sector agency runs a legacy application on an Azure VM. The application vendor prohibits agents, extensions, and code changes on the VM, and the VM cannot be stopped. You need to use Azure Backup to protect the VM's managed disk without downtime. What should you do?

• A. Create an Azure Backup vault and configure Azure Disk Backup for the managed disk.
• B. Create a Recovery Services vault and configure Azure VM Backup for the VM.
• C. Create a Recovery Services vault and configure Azure File Share Backup for a file share.
• D. Create a Recovery Services vault and configure Azure Site Recovery replication for the VM.

Answer: A

Because the vendor forbids VM agents, extensions, and code changes, the normal Azure VM Backup path is unavailable: that path uses a Recovery Services vault and installs the Azure Backup extension on the VM. Azure Disk Backup is configured in an Azure Backup vault and creates snapshot-based, crash-consistent backups of managed disks without installing anything on the VM or stopping it. The strongest distractor is the Recovery Services vault and Azure VM Backup option; for an ordinary VM it is the default answer, but it fails because it requires the extension. The general rule is: when a workload cannot accept agents/extensions or downtime, use a Backup vault with Azure Disk Backup; reserve Recovery Services VM backup for application-consistent VM backup when the extension is acceptable.

Question 8 (Compute)

Your fleet telemetry app sends 35 MB/s of GPS data to an Azure Event Hubs namespace. The namespace is a Standard-tier namespace and is already at its maximum of 20 throughput units, so messages are throttled. You must keep the event stream private to the virtual network and remain on the Standard tier. What should you do?

• A. Add a second namespace, enable the Microsoft.EventHub service endpoint on the subnet, and split traffic.
• B. Upgrade the current namespace to Premium and add processing units to support the higher telemetry load.
• C. Create a private endpoint for the current namespace so all traffic remains on the virtual network.
• D. Enable auto-inflate on the current namespace so it can exceed the 20-throughput-unit maximum during peaks.

Answer: A

Adding a second namespace is correct because an Event Hubs Standard namespace is limited to 20 throughput units, which equals 20 MB/s of ingress; the 35 MB/s workload cannot fit in one namespace. Enabling the Microsoft.EventHub service endpoint on the subnet keeps access private to the virtual network without assigning private IPs. The auto-inflate distractor is the easy one to pick if the quota is skimmed, but auto-inflate only scales within the same 20-throughput-unit cap. The Premium-tier option is ruled out by the stated Standard-tier requirement, and the private-endpoint option changes the network path but does not raise the namespace throughput quota. General rule: scale out a PaaS resource when it reaches a hard per-resource quota, and use service endpoints to keep that traffic on the virtual network.

Question 9 (Networking)

A university research group has a spoke VNet peered to a hub VNet. The hub contains the only NVA firewall approved by the compliance office for Internet traffic. The Research subnet currently uses default system routes, so Internet traffic bypasses the NVA. The university wants the least-cost solution that still meets the compliance policy requiring all Research subnet Internet traffic to be sent through the NVA. The NVA is not BGP-capable, and no new devices may be added. An existing route table already has a 0.0.0.0/0 route to the NVA. What should you do?

• A. Create a route table containing a 0.0.0.0/0 route with next hop type Virtual network gateway and associate it with the Research subnet.
• B. Associate the Research subnet with the existing route table that routes 0.0.0.0/0 traffic to the hub NVA as a virtual appliance.
• C. Apply an NSG to the Research subnet that denies all outbound Internet traffic and allows only traffic destined for the hub NVA's private IP.
• D. Deploy Azure Route Server in the hub and peer it with the NVA so the NVA can advertise its default route to the Research subnet.

Answer: B

The correct action is to associate the Research subnet with the existing route table whose 0.0.0.0/0 route uses the hub NVA as the next hop type Virtual appliance. This overrides the default Internet route and ensures all non-VNet traffic is forwarded to the NVA for inspection. The network security group option is the strongest distractor because it appears to block direct Internet egress, but NSGs only filter traffic; they cannot redirect packets to the NVA. Filtering alone does not satisfy a requirement that traffic be inspected. The Route Server option would add cost and administrative complexity and also requires BGP, which the NVA cannot support. The virtual network gateway option would send traffic to a gateway, not through the approved NVA. General rule: when compliance requires traffic to pass through an intermediate device, use user-defined routes; NSGs filter but do not route.

See exam format for timing, the study plan to schedule remaining domains, and the practice test for a full scored set.

Exam facts on this page come from Microsoft’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.