AZ-104 Renewal Exam Actual Exam 2026/2027 with Detailed Rationales |
Complete Exam-Style Questions | 100% Verified | Pass Guaranteed – A+
Graded
EXAM INFORMATION
Total Questions: 50
Recommended Time: 75 minutes
Passing Threshold: 80%
Exam Format: Multiple Choice Questions (MCQs)
Question Style: Scenario-Based, Applied, and Professional Decision-Making Questions
Difficulty Level: Dynamically Determined Based on Exam Scope
==============================
SECTION 1: Azure Identity and Access Management
Question 1: Which Microsoft Entra ID built-in role should you assign to a support staff
member to allow them to reset passwords for all non-administrative users and
Helpdesk Administrators, without granting the ability to reset passwords for Global
Administrators?
A. Global Administrator
B. Password Administrator
C. Helpdesk Administrator
D. User Administrator
Correct Answer: C
Rationale: The Helpdesk Administrator role has the exact permissions described in the
scenario. The Password Administrator role can reset passwords for all users including
,Global Administrators, which violates the constraint. Global Administrator has full
control and User Administrator focuses on user creation and management rather than
specifically delegated password resets for support staff.
Question 2: A company uses Microsoft Entra ID with a hybrid identity environment. You
need to ensure that when a user account is deleted in the on-premises Active Directory,
the corresponding cloud account is automatically deleted within 30 days. Which feature
must be implemented?
A. Password Hash Sync
B. Pass-through Authentication
C. Soft-delete feature in Entra ID
D. Microsoft Entra Connect Health
Correct Answer: C
Rationale: Microsoft Entra ID implements a 30-day soft-delete retention period for
deleted user accounts. When a user is deleted from on-premises Active Directory and
synchronized, Entra Connect marks the cloud object as deleted, but it remains in the
recycle bin for 30 days before permanent deletion. This is a default behavior that does
not require additional configuration beyond standard synchronization.
Question 3: You have an Azure subscription containing a resource group named RG1.
You need to prevent users from deleting virtual machines in RG1, while still allowing
them to create and manage other resource types in the same resource group. What
should you use?
,A. A built-in role assignment
B. An Azure Policy
C. A management group lock
D. A resource lock
Correct Answer: D
Rationale: A resource lock applied at the resource group level can be set to a specific
resource type, such as virtual machines, or inherited by all resources. A Delete lock
prevents the resource from being deleted by any user, regardless of their RBAC
permissions. Azure Policy can enforce compliance, but a lock is the direct, surefire
method to prevent accidental deletion. Management group locks affect the entire
hierarchy, and role assignments do not explicitly block delete actions if the role includes
delete permissions.
Question 4: Your organization plans to migrate from Azure AD Domain Services to a
fully managed Microsoft Entra Domain Services environment. Which of the following is
a key difference you must account for during the migration planning phase?
A. The new managed domain does not support LDAP over SSL
B. The new managed domain requires a dedicated subnet in a custom virtual network
C. The new managed domain does not support Kerberos authentication
D. The new managed domain automatically synchronizes Group Policy Objects from
on-premises Active Directory
Correct Answer: B
Rationale: The modernized Microsoft Entra Domain Services requires deployment into a
custom virtual network and a dedicated subnet that you define, giving you full control
over the network topology. The legacy Azure AD Domain Services had limitations on
, virtual network integration. The new service still supports LDAP, Kerberos, and does not
automatically synchronize GPOs from on-premises, requiring manual configuration or
migration.
Question 5: You need to configure Privileged Identity Management (PIM) in Microsoft
Entra ID for a user who needs to manage Microsoft 365 groups occasionally. The user
should not have permanent access. Which type of eligibility should you configure?
A. Eligible assignment
B. Active assignment
C. Permanent eligible assignment
D. Direct assignment
Correct Answer: A
Rationale: In Privileged Identity Management, an eligible assignment requires the user
to perform an activation process to use the role for a predetermined duration. This is
the exact scenario requirement for occasional access without permanent standing
privileges. Active or direct assignments grant standing access, which violates the
requirement.
Question 6: You are evaluating security alerts in Microsoft Entra ID Protection. A user's
risk level has been elevated to High due to impossible travel anomalies. The user is
currently logged in and actively working on a legitimate project from a new geographic
location. What is the most appropriate immediate action?
Complete Exam-Style Questions | 100% Verified | Pass Guaranteed – A+
Graded
EXAM INFORMATION
Total Questions: 50
Recommended Time: 75 minutes
Passing Threshold: 80%
Exam Format: Multiple Choice Questions (MCQs)
Question Style: Scenario-Based, Applied, and Professional Decision-Making Questions
Difficulty Level: Dynamically Determined Based on Exam Scope
==============================
SECTION 1: Azure Identity and Access Management
Question 1: Which Microsoft Entra ID built-in role should you assign to a support staff
member to allow them to reset passwords for all non-administrative users and
Helpdesk Administrators, without granting the ability to reset passwords for Global
Administrators?
A. Global Administrator
B. Password Administrator
C. Helpdesk Administrator
D. User Administrator
Correct Answer: C
Rationale: The Helpdesk Administrator role has the exact permissions described in the
scenario. The Password Administrator role can reset passwords for all users including
,Global Administrators, which violates the constraint. Global Administrator has full
control and User Administrator focuses on user creation and management rather than
specifically delegated password resets for support staff.
Question 2: A company uses Microsoft Entra ID with a hybrid identity environment. You
need to ensure that when a user account is deleted in the on-premises Active Directory,
the corresponding cloud account is automatically deleted within 30 days. Which feature
must be implemented?
A. Password Hash Sync
B. Pass-through Authentication
C. Soft-delete feature in Entra ID
D. Microsoft Entra Connect Health
Correct Answer: C
Rationale: Microsoft Entra ID implements a 30-day soft-delete retention period for
deleted user accounts. When a user is deleted from on-premises Active Directory and
synchronized, Entra Connect marks the cloud object as deleted, but it remains in the
recycle bin for 30 days before permanent deletion. This is a default behavior that does
not require additional configuration beyond standard synchronization.
Question 3: You have an Azure subscription containing a resource group named RG1.
You need to prevent users from deleting virtual machines in RG1, while still allowing
them to create and manage other resource types in the same resource group. What
should you use?
,A. A built-in role assignment
B. An Azure Policy
C. A management group lock
D. A resource lock
Correct Answer: D
Rationale: A resource lock applied at the resource group level can be set to a specific
resource type, such as virtual machines, or inherited by all resources. A Delete lock
prevents the resource from being deleted by any user, regardless of their RBAC
permissions. Azure Policy can enforce compliance, but a lock is the direct, surefire
method to prevent accidental deletion. Management group locks affect the entire
hierarchy, and role assignments do not explicitly block delete actions if the role includes
delete permissions.
Question 4: Your organization plans to migrate from Azure AD Domain Services to a
fully managed Microsoft Entra Domain Services environment. Which of the following is
a key difference you must account for during the migration planning phase?
A. The new managed domain does not support LDAP over SSL
B. The new managed domain requires a dedicated subnet in a custom virtual network
C. The new managed domain does not support Kerberos authentication
D. The new managed domain automatically synchronizes Group Policy Objects from
on-premises Active Directory
Correct Answer: B
Rationale: The modernized Microsoft Entra Domain Services requires deployment into a
custom virtual network and a dedicated subnet that you define, giving you full control
over the network topology. The legacy Azure AD Domain Services had limitations on
, virtual network integration. The new service still supports LDAP, Kerberos, and does not
automatically synchronize GPOs from on-premises, requiring manual configuration or
migration.
Question 5: You need to configure Privileged Identity Management (PIM) in Microsoft
Entra ID for a user who needs to manage Microsoft 365 groups occasionally. The user
should not have permanent access. Which type of eligibility should you configure?
A. Eligible assignment
B. Active assignment
C. Permanent eligible assignment
D. Direct assignment
Correct Answer: A
Rationale: In Privileged Identity Management, an eligible assignment requires the user
to perform an activation process to use the role for a predetermined duration. This is
the exact scenario requirement for occasional access without permanent standing
privileges. Active or direct assignments grant standing access, which violates the
requirement.
Question 6: You are evaluating security alerts in Microsoft Entra ID Protection. A user's
risk level has been elevated to High due to impossible travel anomalies. The user is
currently logged in and actively working on a legitimate project from a new geographic
location. What is the most appropriate immediate action?
