AZ-104 RENEWAL EXAM 300 ACTUAL
QUESTIONS AND CORRECT ANSWERS WITH
RATIONALE LATEST UPDATE ALREADY
GRADED A+ ASSURED PASS
Section 1: Manage Azure Identities and Governance (Q1–75)
Sub-Section 1A: Microsoft Entra ID Users, Groups, and
Licenses (Q1–25)
Q1. You need to create a new user in Microsoft Entra ID and assign a Microsoft
365 E5 license. Which sequence of steps should you follow?
A) Create user → Assign license → Configure usage location
B) Create user → Configure usage location → Assign license
C) Assign license → Create user → Configure usage location
D) Configure usage location → Create user → Assign license
Answer: B
Rationale: A usage location must be set on the user before a license can be
assigned, because some Microsoft 365 services are not available in all
countries/regions. The correct order is: create the user, set the usage location, then
assign the license.
Q2. You have a Microsoft Entra ID tenant with 500 users. You need to ensure that
users can reset their own passwords without calling the help desk. What should
you configure?
A) Conditional Access policy
B) Self-Service Password Reset (SSPR)
C) Privileged Identity Management (PIM)
D) Access Reviews
Answer: B
,Rationale: SSPR allows users to reset their own passwords, reducing help desk
calls. It can be enabled for all users or specific groups and requires authentication
methods such as email, phone, or security questions.
Q3. A user reports they cannot sign in because they forgot their password. You
need to reset the password and require the user to change it at next sign-in. What
should you do?
A) Reset the password and enable "Require change at next sign-in"
B) Disable the account and create a new one
C) Assign a Temporary Access Pass
D) Enable SSPR for the user
Answer: A
Rationale: Resetting the password and enabling "Require change at next sign-in"
ensures the user receives a temporary password and must create a new one
immediately upon logging in.
Q4. You need to create a dynamic group that automatically includes all users in the
Sales department. Which membership type should you configure?
A) Assigned
B) Dynamic User
C) Dynamic Device
D) Microsoft 365
Answer: B
Rationale: Dynamic User groups use attribute-based rules (such as department =
Sales) to automatically add or remove members. Assigned groups require manual
membership management.
Q5. You have 50 external partners who need to access resources in your Entra ID
tenant. You need to invite them as guest users. What should you use?
A) Azure AD B2B collaboration
B) Azure AD B2C
C) Conditional Access
D) Access Reviews
Answer: A
,Rationale: Azure AD B2B collaboration allows you to invite external users as
guests. They use their own credentials to access your resources, and you can
manage their access through Conditional Access and access reviews.
Q6. You need to ensure that a user's account is automatically disabled after 30 days
of inactivity. What should you configure?
A) Access Review with automatic disable
B) Conditional Access policy
C) PIM role settings
D) Lifecycle Workflow
Answer: D
Rationale: Lifecycle Workflows in Microsoft Entra ID Governance can
automatically disable or delete accounts based on conditions such as inactivity or
employee leave date.
Q7. What is the primary purpose of Microsoft Entra ID Identity Protection?
A) To manage user licenses
B) To detect and remediate identity-based risks
C) To create dynamic groups
D) To configure SSPR
Answer: B
Rationale: Identity Protection detects risky sign-ins and risky users, and allows you
to configure automated remediation policies such as requiring MFA or password
changes.
Q8. You configure a Conditional Access policy that requires MFA for all users
accessing the Azure portal. A user reports they are prompted for MFA every time.
What should you configure to reduce MFA prompts?
A) Increase sign-in frequency
B) Configure "Remember MFA on trusted devices"
C) Disable MFA
D) Use SSPR
Answer: B
, Rationale: "Remember MFA on trusted devices" reduces the number of MFA
prompts by allowing users to skip MFA on devices they have marked as trusted for
a specified period.
Q9. You need to ensure that users in the Finance department can only sign in from
the corporate network. What should you configure?
A) Named Locations and Conditional Access
B) SSPR and MFA
C) PIM and Access Reviews
D) Dynamic Groups and RBAC
Answer: A
Rationale: Named Locations define trusted IP ranges, and Conditional Access
policies can block or require additional controls when users sign in from outside
those locations.
Q10. What is a Temporary Access Pass (TAP) used for?
A) Permanent access for guest users
B) Onboarding new users who need to set up passwordless authentication
C) Bypassing MFA permanently
D) Sharing passwords securely
Answer: B
Rationale: A Temporary Access Pass is a time-limited passcode that allows users
to register passwordless authentication methods (such as Windows Hello or
Microsoft Authenticator) without needing a password.
Q11. You need to assign a license to a group of users instead of individually. What
should you use?
A) Group-based licensing in Microsoft Entra ID
B) Azure Policy
C) RBAC
D) Access Reviews
Answer: A
QUESTIONS AND CORRECT ANSWERS WITH
RATIONALE LATEST UPDATE ALREADY
GRADED A+ ASSURED PASS
Section 1: Manage Azure Identities and Governance (Q1–75)
Sub-Section 1A: Microsoft Entra ID Users, Groups, and
Licenses (Q1–25)
Q1. You need to create a new user in Microsoft Entra ID and assign a Microsoft
365 E5 license. Which sequence of steps should you follow?
A) Create user → Assign license → Configure usage location
B) Create user → Configure usage location → Assign license
C) Assign license → Create user → Configure usage location
D) Configure usage location → Create user → Assign license
Answer: B
Rationale: A usage location must be set on the user before a license can be
assigned, because some Microsoft 365 services are not available in all
countries/regions. The correct order is: create the user, set the usage location, then
assign the license.
Q2. You have a Microsoft Entra ID tenant with 500 users. You need to ensure that
users can reset their own passwords without calling the help desk. What should
you configure?
A) Conditional Access policy
B) Self-Service Password Reset (SSPR)
C) Privileged Identity Management (PIM)
D) Access Reviews
Answer: B
,Rationale: SSPR allows users to reset their own passwords, reducing help desk
calls. It can be enabled for all users or specific groups and requires authentication
methods such as email, phone, or security questions.
Q3. A user reports they cannot sign in because they forgot their password. You
need to reset the password and require the user to change it at next sign-in. What
should you do?
A) Reset the password and enable "Require change at next sign-in"
B) Disable the account and create a new one
C) Assign a Temporary Access Pass
D) Enable SSPR for the user
Answer: A
Rationale: Resetting the password and enabling "Require change at next sign-in"
ensures the user receives a temporary password and must create a new one
immediately upon logging in.
Q4. You need to create a dynamic group that automatically includes all users in the
Sales department. Which membership type should you configure?
A) Assigned
B) Dynamic User
C) Dynamic Device
D) Microsoft 365
Answer: B
Rationale: Dynamic User groups use attribute-based rules (such as department =
Sales) to automatically add or remove members. Assigned groups require manual
membership management.
Q5. You have 50 external partners who need to access resources in your Entra ID
tenant. You need to invite them as guest users. What should you use?
A) Azure AD B2B collaboration
B) Azure AD B2C
C) Conditional Access
D) Access Reviews
Answer: A
,Rationale: Azure AD B2B collaboration allows you to invite external users as
guests. They use their own credentials to access your resources, and you can
manage their access through Conditional Access and access reviews.
Q6. You need to ensure that a user's account is automatically disabled after 30 days
of inactivity. What should you configure?
A) Access Review with automatic disable
B) Conditional Access policy
C) PIM role settings
D) Lifecycle Workflow
Answer: D
Rationale: Lifecycle Workflows in Microsoft Entra ID Governance can
automatically disable or delete accounts based on conditions such as inactivity or
employee leave date.
Q7. What is the primary purpose of Microsoft Entra ID Identity Protection?
A) To manage user licenses
B) To detect and remediate identity-based risks
C) To create dynamic groups
D) To configure SSPR
Answer: B
Rationale: Identity Protection detects risky sign-ins and risky users, and allows you
to configure automated remediation policies such as requiring MFA or password
changes.
Q8. You configure a Conditional Access policy that requires MFA for all users
accessing the Azure portal. A user reports they are prompted for MFA every time.
What should you configure to reduce MFA prompts?
A) Increase sign-in frequency
B) Configure "Remember MFA on trusted devices"
C) Disable MFA
D) Use SSPR
Answer: B
, Rationale: "Remember MFA on trusted devices" reduces the number of MFA
prompts by allowing users to skip MFA on devices they have marked as trusted for
a specified period.
Q9. You need to ensure that users in the Finance department can only sign in from
the corporate network. What should you configure?
A) Named Locations and Conditional Access
B) SSPR and MFA
C) PIM and Access Reviews
D) Dynamic Groups and RBAC
Answer: A
Rationale: Named Locations define trusted IP ranges, and Conditional Access
policies can block or require additional controls when users sign in from outside
those locations.
Q10. What is a Temporary Access Pass (TAP) used for?
A) Permanent access for guest users
B) Onboarding new users who need to set up passwordless authentication
C) Bypassing MFA permanently
D) Sharing passwords securely
Answer: B
Rationale: A Temporary Access Pass is a time-limited passcode that allows users
to register passwordless authentication methods (such as Windows Hello or
Microsoft Authenticator) without needing a password.
Q11. You need to assign a license to a group of users instead of individually. What
should you use?
A) Group-based licensing in Microsoft Entra ID
B) Azure Policy
C) RBAC
D) Access Reviews
Answer: A
