AZ-104 Practice Questions

To enable developers to use their Azure AD credentials for deploying content to an Azure

App Service web app (App1) via Web Deploy while adhering to the principle of least

privilege, you should assign them the "Website Contributor" role. This Azure built-in role

grants permissions to manage the web app's content and settings, including deployment

operations, without granting excessive permissions like those provided by the "Owner" role.

Web Deploy leverages the Kudu (SCM) service, which supports authentication using Azure

AD credentials for users who have appropriate RBAC permissions on the App Service

instance.

A. Assign the Owner role to the developers: The Owner role grants full access to all

resources in the scope, which violates the principle of least privilege as it provides far more

permissions than needed for deploying web content.

B. Configure app-level credentials for FTPS: This option refers to FTPS, not Web Deploy,

and app-level credentials are not Azure AD user credentials.

D. Configure user-level credentials for FTPS: This option also refers to FTPS, not Web

Deploy. While user-level credentials for FTPS can be linked to Azure AD, the question

specifically asks for Web Deploy.

Azure built-in roles - Website Contributor: Microsoft Learn. "Azure built-in roles." (Search for

"Website Contributor"). This role "Lets you manage websites (not web plans)..." and

includes permissions like Microsoft.Web/sites/ which covers deployment.

URL: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-inroles#website-contributor

Deployment credentials - Azure App Service: Microsoft Learn. "Deployment credentials -

Azure App Service." This document mentions that for authorizing against the SCM endpoint

(used by Web Deploy), you can use "Your Azure AD user (for RBAC-based authorization)."

URL: https://learn.microsoft.com/en-us/azure/app-service/deploy-ftp?tabs=portal#authorizeagainst-the-scm-endpoint (While the main article is about FTP, this section covers SCM

endpoint authorization which is relevant for Web Deploy).

Principle of Least Privilege: Microsoft Learn. "What is the principle of least privilege?"

URL: https://learn.microsoft.com/en-us/azure/active-directory/develop/secure-leastprivileged-access (General concept, applicable here).

To inspect the exact ARM template that Jon Ross originally deployed, you must open the

Resource Group containing the VM, choose Deployments, and look at the Template tab of

the relevant deployment.

Opening the Virtual-Machine blade only exposes Export template/Automation script for that

single VM, which omits other resources (e.g., the additional Storage account) and is not the

original deployment template. Therefore, the solution does not meet the goal.

1. Microsoft Learn View deployment history and template

https://learn.microsoft.com/azure/azure-resource-manager/templates/deploymenthistory?tabs=azure-portal#view-template

(Steps: Resource Group > Deployments > Template)

2. Microsoft Learn Export template for a resource

https://learn.microsoft.com/azure/azure-resource-manager/templates/export-templateportal#export-the-template-for-a-resource

(Export template only includes the selected resource and may differ from the original

deployment template.)

The New-AzureADMSInvitation cmdlet is designed to invite external users to an Azure AD

tenant. When an invitation is created using this cmdlet, a guest user account is provisioned

in the directory. A PowerShell script can iterate through a CSV file and execute this cmdlet

for each entry, effectively creating the 500 guest user accounts as required. This is a

standard and supported method for bulk inviting guest users.

Microsoft. (n.d.). New-AzureADMSInvitation. Microsoft Learn. Retrieved from

https://learn.microsoft.com/en-us/powershell/module/azuread/newazureadmsinvitation?view=azureadps-2.0

Microsoft. (n.d.). Add Azure Active Directory B2B collaboration users in the Azure portal.

Microsoft Learn. (This article discusses B2B collaboration and guest users, for which New-

AzureADMSInvitation is the programmatic method). Retrieved from

https://learn.microsoft.com/en-us/azure/active-directory/external-identities/add-usersadministrator#add-guest-users-to-the-directory

Microsoft. (n.d.). Bulk invite Azure AD B2B collaboration users. Microsoft Learn. (This article

explicitly mentions using PowerShell and New-AzureADMSInvitation for bulk invitations).

Retrieved from https://learn.microsoft.com/en-us/azure/active-directory/externalidentities/bulk-invite-powershell

Assign a tag to each resource: To detail costs per department, you must categorize the resources. Azure resource groups do not automatically pass tags down to the resources they contain (no inheritance by default). Since departments use resources across multiple groups, applying a tag (e.g., Department: Finance) directly to each resource is required to ensure the cost data includes this metadata.

From the Cost analysis blade, filter the view by tag: Once tags are applied and usage data is processed (typically within 24 hours), you use the Cost analysis blade to visualize and group the spending. Filtering by the specific tag isolates the costs relevant to each department.

Download the usage report: The final requirement is to "send a report." After configuring the view or to get the raw data for distribution, you download (or export) the usage report/view as a CSV or Excel file to email to the finance department.

•

Assign a tag to each resource group: This is not granular enough. Since

departments use resources across several resource groups, tagging the group itself

would not provide an accurate cost breakdown for each department.

•

Open the Resource costs blade of each resource group: This action reports

costs aggregated by the resource group, not by the business-oriented department

structure required by the finance team.

Microsoft Learn - Use tags to organize your Azure resources: "Tags applied to the resource group are not inherited by the resources in that resource group."

Source: learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources

Microsoft Learn - Cost Analysis common uses: Describes how to view costs by specific tags using the Cost analysis blade. "In the Azure portal, navigate to Cost Analysis... Select Group by for your tag."

Source: learn.microsoft.com/en-us/azure/cost-management-billing/costs/cost-analysis-common-uses

The core requirement is that on-premises clients must be able to connect directly to a pod's

IP address. This is only possible if the pods receive IP addresses that are routable within

the larger network, including the on-premises environment connected via VPN or

ExpressRoute. The Azure Container Networking Interface (CNI) network plugin achieves

this by assigning each pod an IP address directly from the virtual network's subnet. These

IPs are unique and directly addressable, fulfilling the requirement.

A. kubenet: With kubenet, pods receive IPs from a logically separate address space and

use Network Address Translation (NAT) to communicate, hiding the pod's actual IP behind

the node's IP. This prevents direct connectivity.

C. Hybrid Connection endpoints: This is a feature of Azure App Service and Functions used

for connecting from Azure to on-premises resources. It is not a network model for an AKS

cluster.

D. Azure Private Link: This service provides private connectivity to an endpoint representing

a service (like an internal load balancer), not to individual pod IPs. It is a method to expose

a service, not a fundamental cluster network type.

1. Microsoft Azure Documentation: "Concepts - Networking in Azure Kubernetes Services

(AKS)". This document explicitly compares kubenet and Azure CNI. It states, "With Azure

CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP

addresses must be unique across your network space... This network model allows for

more separation of control and management of resources."

URL: https://learn.microsoft.com/en-us/azure/aks/concepts-network#compare-networkmodels

2. Microsoft Azure Documentation: "Configure Azure CNI networking in Azure Kubernetes

Service (AKS)". This source details the functionality of Azure CNI. It confirms, "Each pod

receives an IP address in the virtual network subnet. Pods can communicate with other

pods in the virtual network and on-premises networks."

URL: https://learn.microsoft.com/en-us/azure/aks/configure-azure-cni

The "Redeploy" action is the correct procedure for moving an Azure virtual machine to a

new physical host within the Azure infrastructure. When a VM is redeployed, Azure shuts it

down, migrates it to a different, healthy host node, and then powers it back on. This process

is specifically designed to address issues with the underlying host, including planned

maintenance, while retaining all configuration options and attached data disks. Therefore,

using the "Redeploy" feature immediately moves VM1 to a different host, meeting the stated

goal.

1. Microsoft Learn. (2023). Redeploy Windows virtual machine to new Azure node. "When

you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then

powers it back on, retaining all your configuration options and associated resources."

https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/redeploy-to-newnode-windows

2. Microsoft Learn. (2023). Maintenance and updates for virtual machines in Azure. "If you

want to proactively move your VM before the planned maintenance window, you can

redeploy your VM." https://learn.microsoft.com/en-us/azure/virtual-machines/maintenanceand-updates#redeploy-your-vm

Virtual network (VNet) peering is the most direct and administratively simple method to

enable communication between virtual machines located in separate virtual networks. Once

VNet peering is established between VNET1 and VNET3, traffic can flow between them

over the Microsoft backbone network as if they were in the same VNet. This solution directly

addresses the connectivity requirement with minimal configuration steps and no need for

gateways or complex routing tables, thus minimizing administrative effort.

A. Create a user-defined route from VNET1 to VNET3: User-defined routes (UDRs) are for

overriding default routing, typically to force traffic through a network virtual appliance (NVA)

or gateway, not for establishing the initial connectivity path between VNets.

B. Create an NSG and associate the NSG to VM1 and VM4: Network Security Groups

(NSGs) act as a firewall to filter traffic. They can permit or deny communication but do not

create the network connectivity path between different VNets.

C. Assign VM4 an IP address of 10.0.1.5/24: This would require moving VM4 to VNET1,

which involves significant administrative effort (e.g., creating a new NIC, potentially

recreating the VM) and is a disruptive change.

Azure virtual network peering: Microsoft Learn. (2024). Azure virtual network peering.

"Azure virtual network peering enables you to seamlessly connect two or more Virtual

Networks in Azure... The traffic between virtual machines in peered virtual networks uses

the Microsoft backbone infrastructure." https://learn.microsoft.com/en-us/azure/virtualnetwork/virtual-network-peering-overview

Virtual network traffic routing (UDRs): Microsoft Learn. (2024). Virtual network traffic routing.

"Azure creates a route table with system routes... You can create custom routes to override

Azure's default routes." https://learn.microsoft.com/en-us/azure/virtual-network/virtualnetworks-udr-overview

Network security groups: Microsoft Learn. (2024). Network security groups. "A network

security group contains security rules that allow or deny inbound network traffic to, or

outbound network traffic from, several types of Azure resources."

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Topic: 16

To configure Azure File Sync on an on-premises server (Server1), you must follow this specific sequence:

1. Install the Azure File Sync agent: This is the primary prerequisite. The agent enables the Windows Server to communicate with the Storage Sync Service in Azure.
2. Register Server1: After the agent installation, the server must be registered with the Storage Sync Service. This establishes a trust relationship between the on-premises server and the Azure resource.
3. Add a server endpoint: Once registered, you add a server endpoint to a Sync Group. This defines the specific path (folder/volume) on the server that will synchronize with the Azure File Share.

Create an Azure on-premises data gateway: This component is used for other services

like Power BI and Logic Apps to access on-premises data; Azure File Sync uses its own

dedicated agent.

Create a Recovery Services vault: This is a component of Azure Backup and Azure Site

Recovery and is not a direct step in the Azure File Sync deployment process.

Install the DFS Replication server role on Server1: Azure File Sync is a distinct

technology from DFS Replication and does not require the DFS-R server role to be installed

to function.

Microsoft Learn. "Deploy Azure File Sync - Install the Azure File Sync agent." Azure Storage, Access Date: November 28, 2025.

Quote: "The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share."

URL: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-portal%2Cproactive-portal#install-the-azure-file-sync-agent

Microsoft Learn. "Deploy Azure File Sync - Register Windows Server with Storage Sync Service." Azure Storage.

Quote: "Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage Sync Service."

URL: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-portal%2Cproactive-portal#register-windows-server-with-storage-sync-service

Microsoft Learn. "Deploy Azure File Sync - Create a server endpoint." Azure Storage.

Quote: "A server endpoint represents a specific location on a registered server, such as a folder on a server volume."

URL: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-portal%2Cproactive-portal#create-a-server-endpoint

The proposed solution will not meet the goal. While the Microsoft Monitoring Agent (MMA)

can collect Windows Event Logs and can be configured to send data to an Azure Storage

account, Azure Monitor alerts for specific event log content (like counting error events) are

typically based on queries against a Log Analytics workspace. Azure Monitor cannot directly

query the detailed content of event logs stored as files/blobs in an Azure Storage account to

count specific event types within a time window for alerting purposes. A Log Analytics

workspace is required to ingest, analyze, and enable querying of these logs for such alert

conditions.

1. Overview of Azure Monitor agents: "The Log Analytics agent, also known as the

Microsoft Monitoring Agent (MMA), collects monitoring data from the guest operating

system of Azure and hybrid virtual machines and sends it to a Log Analytics workspace."

While it can also send to Azure Storage, the primary path for analysis and alerting is Log

Analytics.

Microsoft Learn. (2024). Overview of Azure Monitor agents. Retrieved from

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview

2. Collect Windows event log data sources with Log Analytics agent in Azure Monitor:

"Azure Monitor can collect events from the Windows event log from Windows agents... You

configure collection of Windows events from the Agents configuration menu for the Log

Analytics workspace... You can then create log query alerts to be notified when a particular

event is collected." This clearly indicates Log Analytics workspace as the destination for

event logs intended for alerting.

Microsoft Learn. (2024). Collect Windows event log data sources with Log Analytics agent

in Azure Monitor. Retrieved from https://learn.microsoft.com/en-us/azure/azuremonitor/agents/data-sources-windows-events

3. Log query alerts in Azure Monitor: "Log alerts allow users to use a Log Analytics query to

evaluate resources logs at a set frequency, and fire an alert based on the results." The

target for these queries is a Log Analytics workspace or Application Insights.

Microsoft Learn. (2024). Log query alerts in Azure Monitor. Retrieved from

https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log

An Azure alert rule is created for a specific signal on a defined scope. Since there are four

distinct signals to be monitored (Ingress, Egress, Delete storage account, Restore blob

ranges), a minimum of four separate alert rules are required.

An action group is a reusable collection of notification p

and actions. To

determine the minimum number of action groups, we identify the unique sets of users to be

notified:

1. User1 and User3

2. User1 only

3. User1, User2, and User3

These three distinct notification requirements necessitate a minimum of three action

groups. The action group configured to notify User1 and User3 can be reused for both the

"Ingress" and "Restore blob ranges" alert rules.

References:

1. Microsoft Learn, Alert rules in Azure Monitor: This document states, "An alert rule

monitors your telemetry and captures a signal... The rule combines the resources to

be monitored, the signal or telemetry from the resource, and conditions." This

confirms that each unique signal requires its own rule.

o URL: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alertsoverview#alert-rules

2. Microsoft Learn, Action groups: This documentation explains, "An action group is

a collection of notification preferences... You can use an action group with more than

one alert rule; this allows you to use the same notification methods whenever those

alerts are triggered." This supports the principle of creating reusable action groups

for unique sets of recipients.

o URL: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/actiongroups