AZ-104 RENEWAL EXAM (COMPREHENSIVE VERSION
2026/2027)
COMPREHENSIVE QUESTIONS AND VERIFIED DETAILED
SOLUTIONS (MULTIPLE CHOICES) | 100% CORRECT!!
QUESTION 1
You have an Azure subscription that contains a virtual network named
VNet1. You deploy an Azure virtual machine named VM1 that runs
Windows Server 2022. You need to ensure that a developer can manage
VM1 via Azure Bastion. What should you configure?
A. A network security group rule to allow inbound RDP on port 3389.
B. A network security group rule to allow inbound HTTPS on port 443.
C. A network security group rule to allow inbound SSH on port 22.
D. A network security group rule to allow inbound RDP on port 3389
and SSH on port 22.
Answer: B
Rationale: Azure Bastion provides secure RDP/SSH connectivity directly
through the Azure portal over TLS. It does not require a public IP
address on the VM. For Azure Bastion to work, the network security
group (NSG) must allow inbound HTTPS (port 443) from the Azure
Bastion service or the VirtualNetwork service tag. It does not require
opening RDP (3389) or SSH (22) to the internet, as the connection is
made over the TLS tunnel .
,QUESTION 2
You have an Azure subscription that contains a resource group named
RG1. You need to prevent the accidental deletion of a virtual machine
named VM1 in RG1. The solution must prevent administrators from
deleting VM1. What should you do?
A. Create an Azure Policy that denies the deletion of resources.
B. Assign the VM1 contributor role to the administrators.
C. Move VM1 to a different subscription.
D. Apply a CanNotDelete resource lock to VM1.
Answer: D
Rationale: A CanNotDelete lock is designed to prevent the deletion of a
resource by any user or service, including administrators. This is the
correct way to guard against accidental deletion . Azure Policy is used
for governance and compliance, not for enforcing a single resource's
lock against deletion, and moving the subscription does not prevent
deletion . Assigning the Contributor role would allow the administrators
to delete the resource, which defeats the purpose.
QUESTION 3
You have an Azure subscription. You plan to deploy a virtual machine
that runs a custom Linux distribution. You need to ensure that the
virtual machine is patched automatically. Which service should you use?
A. Azure Update Management Center
B. Azure Automation State Configuration
C. Azure Policy
D. Azure Site Recovery
Answer: A
Rationale: Azure Update Management Center (now called Azure
Update Manager) is the unified service for managing and scheduling
,operating system updates for both Windows and Linux virtual machines
across Azure, on-premises, and other cloud environments . It provides a
centralized view of update compliance and allows for automated
patching schedules.
QUESTION 4
You have an Azure subscription that contains a Recovery Services vault.
You need to back up an Azure virtual machine. Which of the following is
a prerequisite for backing up the virtual machine?
A. The virtual machine must be in the same region as the Recovery
Services vault.
B. The virtual machine must be in the same resource group as the
Recovery Services vault.
C. The virtual machine must be in the same subscription as the
Recovery Services vault.
D. The virtual machine must be a managed disk.
Answer: A
Rationale: For Azure VM backup, the virtual machine must reside in the
same region as the Recovery Services vault . They do not need to be in
the same subscription or resource group . Backing up VMs with
unmanaged disks is also supported, though managed disks are
recommended .
QUESTION 5
You have an Azure subscription that contains a virtual network named
VNet1. VNet1 contains a subnet named Subnet1. You deploy an Azure
virtual machine named VM1 to Subnet1. You need to ensure that VM1
can access the internet. What should you do?
A. Assign a public IP address to the network interface of VM1.
B. Configure a site-to-site VPN gateway.
, C. Configure a network virtual appliance.
D. Configure Azure DNS.
Answer: A
Rationale: To provide outbound internet access to a VM, you can assign
a public IP address to its network interface. This is the simplest method
for direct internet access . Site-to-site VPN and network virtual
appliances are for hybrid or private connectivity, not for simply
providing internet access . Azure DNS is for name resolution.
QUESTION 6
You have an Azure subscription that contains a resource group named
RG1. You deploy a virtual machine named VM1 to RG1. You need to
move VM1 to a different resource group named RG2. What should you
do?
A. Delete and redeploy VM1 to RG2.
B. Move VM1 from RG1 to RG2 by using the Azure portal.
C. Create a new VM in RG2 based on a snapshot of VM1.
D. Change the resource group property of VM1 in the Azure Resource
Manager template.
Answer: B
Rationale: Moving a resource from one resource group to another is a
supported operation in Azure . You can do this through the Azure portal,
PowerShell, or Azure CLI. This does not require redeployment or
recreating the VM . You cannot simply edit the ARM template to change
the resource group after deployment; it must be moved.
QUESTION 7
You have an Azure subscription. You plan to deploy a web application
that requires a custom domain name. Which Azure service should you
use to host the web application?
2026/2027)
COMPREHENSIVE QUESTIONS AND VERIFIED DETAILED
SOLUTIONS (MULTIPLE CHOICES) | 100% CORRECT!!
QUESTION 1
You have an Azure subscription that contains a virtual network named
VNet1. You deploy an Azure virtual machine named VM1 that runs
Windows Server 2022. You need to ensure that a developer can manage
VM1 via Azure Bastion. What should you configure?
A. A network security group rule to allow inbound RDP on port 3389.
B. A network security group rule to allow inbound HTTPS on port 443.
C. A network security group rule to allow inbound SSH on port 22.
D. A network security group rule to allow inbound RDP on port 3389
and SSH on port 22.
Answer: B
Rationale: Azure Bastion provides secure RDP/SSH connectivity directly
through the Azure portal over TLS. It does not require a public IP
address on the VM. For Azure Bastion to work, the network security
group (NSG) must allow inbound HTTPS (port 443) from the Azure
Bastion service or the VirtualNetwork service tag. It does not require
opening RDP (3389) or SSH (22) to the internet, as the connection is
made over the TLS tunnel .
,QUESTION 2
You have an Azure subscription that contains a resource group named
RG1. You need to prevent the accidental deletion of a virtual machine
named VM1 in RG1. The solution must prevent administrators from
deleting VM1. What should you do?
A. Create an Azure Policy that denies the deletion of resources.
B. Assign the VM1 contributor role to the administrators.
C. Move VM1 to a different subscription.
D. Apply a CanNotDelete resource lock to VM1.
Answer: D
Rationale: A CanNotDelete lock is designed to prevent the deletion of a
resource by any user or service, including administrators. This is the
correct way to guard against accidental deletion . Azure Policy is used
for governance and compliance, not for enforcing a single resource's
lock against deletion, and moving the subscription does not prevent
deletion . Assigning the Contributor role would allow the administrators
to delete the resource, which defeats the purpose.
QUESTION 3
You have an Azure subscription. You plan to deploy a virtual machine
that runs a custom Linux distribution. You need to ensure that the
virtual machine is patched automatically. Which service should you use?
A. Azure Update Management Center
B. Azure Automation State Configuration
C. Azure Policy
D. Azure Site Recovery
Answer: A
Rationale: Azure Update Management Center (now called Azure
Update Manager) is the unified service for managing and scheduling
,operating system updates for both Windows and Linux virtual machines
across Azure, on-premises, and other cloud environments . It provides a
centralized view of update compliance and allows for automated
patching schedules.
QUESTION 4
You have an Azure subscription that contains a Recovery Services vault.
You need to back up an Azure virtual machine. Which of the following is
a prerequisite for backing up the virtual machine?
A. The virtual machine must be in the same region as the Recovery
Services vault.
B. The virtual machine must be in the same resource group as the
Recovery Services vault.
C. The virtual machine must be in the same subscription as the
Recovery Services vault.
D. The virtual machine must be a managed disk.
Answer: A
Rationale: For Azure VM backup, the virtual machine must reside in the
same region as the Recovery Services vault . They do not need to be in
the same subscription or resource group . Backing up VMs with
unmanaged disks is also supported, though managed disks are
recommended .
QUESTION 5
You have an Azure subscription that contains a virtual network named
VNet1. VNet1 contains a subnet named Subnet1. You deploy an Azure
virtual machine named VM1 to Subnet1. You need to ensure that VM1
can access the internet. What should you do?
A. Assign a public IP address to the network interface of VM1.
B. Configure a site-to-site VPN gateway.
, C. Configure a network virtual appliance.
D. Configure Azure DNS.
Answer: A
Rationale: To provide outbound internet access to a VM, you can assign
a public IP address to its network interface. This is the simplest method
for direct internet access . Site-to-site VPN and network virtual
appliances are for hybrid or private connectivity, not for simply
providing internet access . Azure DNS is for name resolution.
QUESTION 6
You have an Azure subscription that contains a resource group named
RG1. You deploy a virtual machine named VM1 to RG1. You need to
move VM1 to a different resource group named RG2. What should you
do?
A. Delete and redeploy VM1 to RG2.
B. Move VM1 from RG1 to RG2 by using the Azure portal.
C. Create a new VM in RG2 based on a snapshot of VM1.
D. Change the resource group property of VM1 in the Azure Resource
Manager template.
Answer: B
Rationale: Moving a resource from one resource group to another is a
supported operation in Azure . You can do this through the Azure portal,
PowerShell, or Azure CLI. This does not require redeployment or
recreating the VM . You cannot simply edit the ARM template to change
the resource group after deployment; it must be moved.
QUESTION 7
You have an Azure subscription. You plan to deploy a web application
that requires a custom domain name. Which Azure service should you
use to host the web application?
