WGU D338 | AZ-104 PRACTICE EXAM | 2026–2027
WGU D338 AZ-104 Practice Exam
2026–2027 | 128 Questions & Detailed Rationales
Exam Focus & Quick Reference
Identity & governance: Microsoft Entra ID, Azure RBAC, management groups, resource locks, Azure
Policy, managed identities.
Storage: Blob, Files, managed disks, LRS/ZRS/GRS, SAS, lifecycle policies, private endpoints.
Compute: Virtual machines, scale sets, App Service, container services, availability and backups.
Networking: VNets, NSGs, peering, VPN, ExpressRoute, NAT Gateway, private DNS, load balancing.
Monitoring & recovery: Azure Monitor, Activity Log, alerts, Azure Backup, disaster recovery, budgets.
Independent educational practice material • Page 1
,WGU D338 | AZ-104 PRACTICE EXAM | 2026–2027
Practice Questions 1–128
Question 1. [Identity] A company needs single sign-on for its Azure workforce applications. Which
Azure solution or concept is the best fit?
A. Azure Files
B. Microsoft Entra ID
C. Azure DNS
D. Azure Monitor
Correct Answer: B. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Files addresses a different capability and does not
directly satisfy this requirement. C — Azure DNS addresses a different capability and does not
directly satisfy this requirement. D — Azure Monitor addresses a different capability and does not
directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 2. [Identity] During a design review, an architect must address this requirement: a
company needs single sign-on for its Azure workforce applications. What should the
implementation plan specify?
A. Azure Monitor
B. Azure Files
C. Microsoft Entra ID
D. Azure DNS
Correct Answer: C. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Monitor addresses a different capability and does
not directly satisfy this requirement. B — Azure Files addresses a different capability and does not
Independent educational practice material • Page 2
,WGU D338 | AZ-104 PRACTICE EXAM | 2026–2027
directly satisfy this requirement. D — Azure DNS addresses a different capability and does not
directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 3. [Identity] Administrators must authenticate with an additional factor before privileged
sign-in. Which Azure solution or concept is the best fit?
A. Azure Policy
B. Storage lifecycle management
C. Azure Bastion
D. Microsoft Entra multifactor authentication
Correct Answer: D. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: A — Azure Policy addresses a different capability and does
not directly satisfy this requirement. B — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. C — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 4. [Identity] During a design review, an architect must address this requirement:
administrators must authenticate with an additional factor before privileged sign-in. What should
the implementation plan specify?
A. Microsoft Entra multifactor authentication
B. Azure Policy
C. Storage lifecycle management
D. Azure Bastion
Correct Answer: A. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: B — Azure Policy addresses a different capability and does
not directly satisfy this requirement. C — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. D — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Independent educational practice material • Page 3
, WGU D338 | AZ-104 PRACTICE EXAM | 2026–2027
Question 5. [Identity] Access should require a compliant device and block risky locations. Which
Azure solution or concept is the best fit?
A. Azure Cost Management
B. Conditional Access
C. Azure Backup
D. NSG
Correct Answer: B. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — Azure Cost Management addresses a different capability
and does not directly satisfy this requirement. C — Azure Backup addresses a different capability
and does not directly satisfy this requirement. D — NSG addresses a different capability and does
not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 6. [Identity] During a design review, an architect must address this requirement: access
should require a compliant device and block risky locations. What should the implementation plan
specify?
A. NSG
B. Azure Cost Management
C. Conditional Access
D. Azure Backup
Correct Answer: C. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — NSG addresses a different capability and does not
directly satisfy this requirement. B — Azure Cost Management addresses a different capability and
does not directly satisfy this requirement. D — Azure Backup addresses a different capability and
does not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 7. [Identity] An operator needs permission to restart one VM but not administer its
network. Which Azure solution or concept is the best fit?
A. Subscription Owner everywhere
Independent educational practice material • Page 4
WGU D338 AZ-104 Practice Exam
2026–2027 | 128 Questions & Detailed Rationales
Exam Focus & Quick Reference
Identity & governance: Microsoft Entra ID, Azure RBAC, management groups, resource locks, Azure
Policy, managed identities.
Storage: Blob, Files, managed disks, LRS/ZRS/GRS, SAS, lifecycle policies, private endpoints.
Compute: Virtual machines, scale sets, App Service, container services, availability and backups.
Networking: VNets, NSGs, peering, VPN, ExpressRoute, NAT Gateway, private DNS, load balancing.
Monitoring & recovery: Azure Monitor, Activity Log, alerts, Azure Backup, disaster recovery, budgets.
Independent educational practice material • Page 1
,WGU D338 | AZ-104 PRACTICE EXAM | 2026–2027
Practice Questions 1–128
Question 1. [Identity] A company needs single sign-on for its Azure workforce applications. Which
Azure solution or concept is the best fit?
A. Azure Files
B. Microsoft Entra ID
C. Azure DNS
D. Azure Monitor
Correct Answer: B. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Files addresses a different capability and does not
directly satisfy this requirement. C — Azure DNS addresses a different capability and does not
directly satisfy this requirement. D — Azure Monitor addresses a different capability and does not
directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 2. [Identity] During a design review, an architect must address this requirement: a
company needs single sign-on for its Azure workforce applications. What should the
implementation plan specify?
A. Azure Monitor
B. Azure Files
C. Microsoft Entra ID
D. Azure DNS
Correct Answer: C. Microsoft Entra ID
Detailed Rationale: Entra ID provides cloud identity and authentication for workforce applications.
Why the Other Options Are Incorrect: A — Azure Monitor addresses a different capability and does
not directly satisfy this requirement. B — Azure Files addresses a different capability and does not
Independent educational practice material • Page 2
,WGU D338 | AZ-104 PRACTICE EXAM | 2026–2027
directly satisfy this requirement. D — Azure DNS addresses a different capability and does not
directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 3. [Identity] Administrators must authenticate with an additional factor before privileged
sign-in. Which Azure solution or concept is the best fit?
A. Azure Policy
B. Storage lifecycle management
C. Azure Bastion
D. Microsoft Entra multifactor authentication
Correct Answer: D. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: A — Azure Policy addresses a different capability and does
not directly satisfy this requirement. B — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. C — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 4. [Identity] During a design review, an architect must address this requirement:
administrators must authenticate with an additional factor before privileged sign-in. What should
the implementation plan specify?
A. Microsoft Entra multifactor authentication
B. Azure Policy
C. Storage lifecycle management
D. Azure Bastion
Correct Answer: A. Microsoft Entra multifactor authentication
Detailed Rationale: MFA adds an independent verification factor to strengthen sign-in.
Why the Other Options Are Incorrect: B — Azure Policy addresses a different capability and does
not directly satisfy this requirement. C — Storage lifecycle management addresses a different
capability and does not directly satisfy this requirement. D — Azure Bastion addresses a different
capability and does not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Independent educational practice material • Page 3
, WGU D338 | AZ-104 PRACTICE EXAM | 2026–2027
Question 5. [Identity] Access should require a compliant device and block risky locations. Which
Azure solution or concept is the best fit?
A. Azure Cost Management
B. Conditional Access
C. Azure Backup
D. NSG
Correct Answer: B. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — Azure Cost Management addresses a different capability
and does not directly satisfy this requirement. C — Azure Backup addresses a different capability
and does not directly satisfy this requirement. D — NSG addresses a different capability and does
not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 6. [Identity] During a design review, an architect must address this requirement: access
should require a compliant device and block risky locations. What should the implementation plan
specify?
A. NSG
B. Azure Cost Management
C. Conditional Access
D. Azure Backup
Correct Answer: C. Conditional Access
Detailed Rationale: Conditional Access evaluates identity and contextual signals when enforcing
access policies.
Why the Other Options Are Incorrect: A — NSG addresses a different capability and does not
directly satisfy this requirement. B — Azure Cost Management addresses a different capability and
does not directly satisfy this requirement. D — Azure Backup addresses a different capability and
does not directly satisfy this requirement.
───────────────────────────────────────────────────────────────────────────
Question 7. [Identity] An operator needs permission to restart one VM but not administer its
network. Which Azure solution or concept is the best fit?
A. Subscription Owner everywhere
Independent educational practice material • Page 4
