{"id":11781,"date":"2026-09-14T12:07:02","date_gmt":"2026-09-14T12:07:02","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=11781"},"modified":"2026-09-14T12:07:02","modified_gmt":"2026-09-14T12:07:02","slug":"microsoft-az-104-practice-test-questions-and-exam-dumps-part-7-q121-140","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/microsoft-az-104-practice-test-questions-and-exam-dumps-part-7-q121-140\/","title":{"rendered":"Microsoft AZ-104 Practice Test Questions and Exam Dumps Part 7 Q121-140"},"content":{"rendered":"

View Full\u00a0Microsoft AZ-104 Exam Dumps<\/a>\u00a0and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 121<\/b><\/h3>\n

You need to assign permissions to a user so they can manage Azure virtual machines but cannot modify networking resources. Which Azure RBAC role should you consider?<\/b><\/p>\n

    \n
  1. Virtual Machine Contributor<\/span><\/li>\n
  2. Owner<\/span><\/li>\n
  3. Reader<\/span><\/li>\n
  4. Network Contributor<\/span><\/li>\n<\/ol>\n

    Correct Answer: 1<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    The Virtual Machine Contributor role allows a user to manage virtual machines without granting permissions to manage the virtual network or other networking resources. This follows the principle of least privilege by providing only the permissions required for the user’s responsibilities. Owner provides full access, including role assignments, while Reader provides read-only access. Network Contributor focuses on networking resources rather than virtual machines. Therefore, Virtual Machine Contributor is the most appropriate role when a user needs to manage VMs but should not modify networking.<\/span><\/p>\n

    Question 122<\/b><\/h3>\n

    You need to grant a user permission to manage virtual networks, network interfaces, and network security groups, but not other Azure resources. Which role should you use?<\/b><\/p>\n

      \n
    1. Network Contributor<\/span><\/li>\n
    2. Virtual Machine Contributor<\/span><\/li>\n
    3. Reader<\/span><\/li>\n
    4. Owner<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      The Network Contributor role allows users to manage Azure networking resources such as virtual networks, network interfaces, and network security groups. It does not provide full management permissions across all Azure resources. Virtual Machine Contributor focuses on VM management, Reader provides read-only access, and Owner provides unrestricted resource management along with role assignment permissions. Therefore, Network Contributor is the correct role when an administrator needs to manage networking resources while limiting access to unrelated Azure services.<\/span><\/p>\n

      Question 123<\/b><\/h3>\n

      You need to allow an application running on an Azure VM to access Azure resources without storing credentials in application code. Which feature should you use?<\/b><\/p>\n

        \n
      1. Managed Identity<\/span><\/li>\n
      2. Public IP Address<\/span><\/li>\n
      3. Resource Lock<\/span><\/li>\n
      4. Network Security Group<\/span><\/li>\n<\/ol>\n

        Correct Answer: 1<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        Managed identities allow Azure resources to authenticate to supported services without requiring developers to store credentials, passwords, or secrets in application code. Azure automatically manages the identity’s credentials. The application can use the identity to access resources such as Key Vault, Storage, or other services after appropriate permissions are assigned. Public IP addresses provide network connectivity, Resource Locks prevent accidental changes, and NSGs control network traffic. Therefore, Managed Identity is the best solution for secure application authentication without embedded credentials.<\/span><\/p>\n

        Question 124<\/b><\/h3>\n

        You need to store passwords, certificates, and secrets securely for Azure applications. Which Azure service should you use?<\/b><\/p>\n

          \n
        1. Azure Key Vault<\/span><\/li>\n
        2. Azure Storage Account<\/span><\/li>\n
        3. Azure Monitor<\/span><\/li>\n
        4. Azure Traffic Manager<\/span><\/li>\n<\/ol>\n

          Correct Answer: 1<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          Azure Key Vault is designed to securely store and manage sensitive information such as passwords, encryption keys, certificates, and application secrets. Applications can retrieve secrets from Key Vault without storing sensitive values directly in configuration files or source code. Azure Storage provides data storage, Azure Monitor handles monitoring, and Traffic Manager distributes application traffic. Key Vault also integrates with Microsoft Entra ID and managed identities for controlled access. Therefore, Azure Key Vault is the correct service for securely managing application secrets and certificates.<\/span><\/p>\n

          Question 125<\/b><\/h3>\n

          You need to create a storage account that remains available if an entire Azure availability zone becomes unavailable. Which redundancy option should you select?<\/b><\/p>\n

            \n
          1. Locally-redundant storage<\/span><\/li>\n
          2. Zone-redundant storage<\/span><\/li>\n
          3. Geo-redundant storage<\/span><\/li>\n
          4. Read-access geo-redundant storage<\/span><\/li>\n<\/ol>\n

            Correct Answer: 2<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            Zone-redundant storage, or ZRS, synchronously replicates data across multiple availability zones within an Azure region. This protects data against failures affecting an individual availability zone. Locally redundant storage keeps multiple copies within a single datacenter or availability zone and does not provide the same zone-level protection. Geo-redundant options replicate data to another region, providing geographic protection. Therefore, ZRS is the appropriate redundancy option when the requirement is protection against an availability zone failure within the same region.<\/span><\/p>\n

            Question 126<\/b><\/h3>\n

            You need to protect storage data against a regional Azure outage by replicating it to another Azure region. Which redundancy option should you use?<\/b><\/p>\n

              \n
            1. LRS<\/span><\/li>\n
            2. ZRS<\/span><\/li>\n
            3. GRS<\/span><\/li>\n
            4. Premium SSD<\/span><\/li>\n<\/ol>\n

              Correct Answer: 3<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              Geo-redundant storage, or GRS, replicates storage data from the primary region to a secondary Azure region. This provides protection against a regional disaster or major outage affecting the primary region. LRS provides redundancy within a single location, while ZRS replicates data across availability zones in the same region. Premium SSD is a VM disk type rather than a storage account redundancy option. Therefore, GRS is the correct choice when data must be replicated to another Azure region for geographic protection.<\/span><\/p>\n

              Question 127<\/b><\/h3>\n

              You need to store frequently accessed Blob Storage data with low access latency. Which access tier should you choose?<\/b><\/p>\n

                \n
              1. Archive<\/span><\/li>\n
              2. Cool<\/span><\/li>\n
              3. Hot<\/span><\/li>\n
              4. Offline<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                The Hot access tier is designed for data that is accessed frequently. It provides lower access costs compared with some alternatives when data is regularly retrieved, making it appropriate for active application data and frequently accessed files. The Cool tier is intended for data accessed less frequently, while Archive is designed for rarely accessed data with longer retrieval times. Offline is not an Azure Blob Storage access tier. Therefore, the Hot access tier is the correct choice for frequently accessed blob data.<\/span><\/p>\n

                Question 128<\/b><\/h3>\n

                You need to store data that will rarely be accessed and can tolerate a longer retrieval time. Which Blob Storage access tier should you use?<\/b><\/p>\n

                  \n
                1. Hot<\/span><\/li>\n
                2. Cool<\/span><\/li>\n
                3. Archive<\/span><\/li>\n
                4. Premium<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 3<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  The Archive tier is designed for data that is rarely accessed and can tolerate longer retrieval times. It provides a lower storage cost compared with frequently accessed tiers, making it suitable for long-term retention, backups, and compliance data. Before archived data can be accessed, it generally needs to be rehydrated to an online tier, which can take time. The Hot tier is intended for frequent access, while Cool is designed for less frequent but still relatively accessible data. Therefore, Archive is the correct choice.<\/span><\/p>\n

                  Question 129<\/b><\/h3>\n

                  You need to create a private connection to an Azure Storage account from a virtual network. Which DNS feature may be required to resolve the private endpoint name?<\/b><\/p>\n

                    \n
                  1. Azure Private DNS<\/span><\/li>\n
                  2. Azure Traffic Manager<\/span><\/li>\n
                  3. Azure Public DNS<\/span><\/li>\n
                  4. Azure Load Balancer<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Azure Private DNS can provide name resolution for private endpoints within a virtual network. When a private endpoint is created, applications need to resolve the service’s hostname to the private IP address associated with the endpoint. A Private DNS zone can be linked to the virtual network to provide this resolution. Traffic Manager distributes traffic between endpoints, while Load Balancer distributes network traffic. Public DNS is not intended for resolving private endpoint addresses. Therefore, Azure Private DNS is the appropriate feature.<\/span><\/p>\n

                    Question 130<\/b><\/h3>\n

                    You need to determine whether a network security group is allowing or denying traffic between a source and destination. Which Network Watcher feature should you use?<\/b><\/p>\n

                      \n
                    1. IP flow verify<\/span><\/li>\n
                    2. Connection monitor<\/span><\/li>\n
                    3. Packet capture<\/span><\/li>\n
                    4. Topology<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 1<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Network Watcher’s IP flow verify feature checks whether a specific network traffic flow is allowed or denied by security rules. You provide details such as the source, destination, protocol, and port, and Azure evaluates the applicable NSG rules. Connection Monitor is used to monitor connectivity over time, Packet Capture captures network traffic for analysis, and Topology provides a visual representation of network resources and relationships. Therefore, IP flow verify is the correct feature for determining whether NSG rules allow or deny a specific traffic flow.<\/span><\/p>\n

                      Question 131<\/b><\/h3>\n

                      You need to monitor connectivity between two Azure resources continuously and identify network performance issues. Which Network Watcher feature should you use?<\/b><\/p>\n

                        \n
                      1. Connection Monitor<\/span><\/li>\n
                      2. IP flow verify<\/span><\/li>\n
                      3. Packet Capture<\/span><\/li>\n
                      4. NSG Diagnostics<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 1<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Network Watcher’s Connection Monitor continuously tests connectivity between endpoints and provides information about network performance and availability. It can help identify connectivity failures, latency problems, and other network issues. IP flow verify checks whether a specific traffic flow is allowed or denied at a point in time. Packet Capture collects network packets for detailed analysis. Therefore, Connection Monitor is the best choice when you need ongoing connectivity monitoring between Azure resources.<\/span><\/p>\n

                        Question 132<\/b><\/h3>\n

                        You need to capture network packets from an Azure virtual machine for troubleshooting. Which Network Watcher feature should you use?<\/b><\/p>\n

                          \n
                        1. Packet Capture<\/span><\/li>\n
                        2. Connection Monitor<\/span><\/li>\n
                        3. IP flow verify<\/span><\/li>\n
                        4. Traffic Manager<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 1<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Network Watcher’s Packet Capture feature allows administrators to capture network traffic from a virtual machine for troubleshooting and analysis. Captured packets can help identify connectivity problems, unexpected traffic, protocol issues, and application communication problems. Connection Monitor focuses on ongoing connectivity and performance, while IP flow verify evaluates whether specific traffic is allowed or denied. Traffic Manager is a DNS-based traffic distribution service. Therefore, Packet Capture is the correct Network Watcher feature when detailed network traffic needs to be examined.<\/span><\/p>\n

                          Question 133<\/b><\/h3>\n

                          You need to create an alert when the CPU utilization of a virtual machine remains above a specific threshold. Which Azure service should you use?<\/b><\/p>\n

                            \n
                          1. Azure Monitor<\/span><\/li>\n
                          2. Azure Policy<\/span><\/li>\n
                          3. Azure Advisor<\/span><\/li>\n
                          4. Azure Resource Manager<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            Azure Monitor can collect metrics such as virtual machine CPU utilization and create metric alerts based on defined thresholds. An administrator can configure an alert to trigger when CPU usage exceeds a specified percentage for a defined period. This helps identify sustained resource pressure and potential performance problems. Azure Policy enforces governance rules, Advisor provides recommendations, and Resource Manager manages Azure resources. Therefore, Azure Monitor is the correct service for creating alerts based on VM CPU utilization.<\/span><\/p>\n

                            Question 134<\/b><\/h3>\n

                            You need to send an email notification when an Azure Monitor alert is triggered. Which component should you configure?<\/b><\/p>\n

                              \n
                            1. Action Group<\/span><\/li>\n
                            2. Resource Lock<\/span><\/li>\n
                            3. Availability Set<\/span><\/li>\n
                            4. Route Table<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Azure Monitor Action Groups define the actions that occur when an alert is triggered. An action group can send email notifications, SMS messages, push notifications, invoke webhooks, or trigger automation depending on the configured action types. Resource Locks protect resources, Availability Sets improve VM availability, and Route Tables control network routing. Therefore, an Action Group is the correct component for configuring email notifications when an Azure Monitor alert is triggered.<\/span><\/p>\n

                              Question 135<\/b><\/h3>\n

                              You need to ensure that two virtual machines are placed in different fault and update domains to improve availability. Which Azure feature should you use?<\/b><\/p>\n

                                \n
                              1. Availability Set<\/span><\/li>\n
                              2. Resource Group<\/span><\/li>\n
                              3. Virtual Network<\/span><\/li>\n
                              4. Network Security Group<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                An Azure Availability Set groups virtual machines so Azure can distribute them across fault domains and update domains. Fault domains help protect against physical hardware failures, while update domains help reduce the impact of planned maintenance. This arrangement improves application availability when multiple VMs are deployed in the same region. A resource group organizes resources, a virtual network provides network connectivity, and an NSG controls network traffic. Therefore, an Availability Set is the correct feature for distributing VMs across fault and update domains.<\/span><\/p>\n

                                Question 136<\/b><\/h3>\n

                                You need to protect a virtual machine workload from datacenter-level failures by distributing VM instances across physically separate locations within an Azure region. Which feature should you use?<\/b><\/p>\n

                                  \n
                                1. Availability Zones<\/span><\/li>\n
                                2. Availability Set<\/span><\/li>\n
                                3. Resource Locks<\/span><\/li>\n
                                4. Tags<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  Azure Availability Zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. Deploying application instances across multiple zones can protect workloads against failures affecting an entire datacenter or zone. Availability Sets provide fault and update domain distribution within a datacenter but do not provide the same level of physical separation. Resource Locks prevent accidental changes, while tags organize resources. Therefore, Availability Zones are the appropriate choice for protection against datacenter-level failures.<\/span><\/p>\n

                                  Question 137<\/b><\/h3>\n

                                  You need to create a subnet for application servers inside an Azure virtual network. Which resource must the subnet belong to?<\/b><\/p>\n

                                    \n
                                  1. Virtual Network<\/span><\/li>\n
                                  2. Resource Group<\/span><\/li>\n
                                  3. Network Security Group<\/span><\/li>\n
                                  4. Route Table<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    An Azure subnet is a logical subdivision of an Azure Virtual Network. Every subnet belongs to a virtual network and uses a portion of the virtual network’s IP address space. Subnets help organize resources and can have network security groups, route tables, and other configurations associated with them. A resource group contains resources but does not directly contain subnets. NSGs and route tables are associated with network components but do not own subnets. Therefore, a subnet must belong to a Virtual Network.<\/span><\/p>\n

                                    Question 138<\/b><\/h3>\n

                                    You need to allow only HTTPS traffic from the internet to a web server subnet. Which NSG rule should you configure?<\/b><\/p>\n

                                      \n
                                    1. Allow inbound TCP port 80<\/span><\/li>\n
                                    2. Allow inbound TCP port 443<\/span><\/li>\n
                                    3. Allow outbound TCP port 443<\/span><\/li>\n
                                    4. Allow inbound UDP port 443<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 2<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      HTTPS uses TCP port 443, so an inbound NSG rule allowing TCP traffic on port 443 is required for users on the internet to access the web server securely over HTTPS. Port 80 is normally associated with HTTP rather than HTTPS. The rule must be inbound because traffic is entering the web server from external clients. UDP port 443 is not the standard protocol for traditional HTTPS traffic. Therefore, allowing inbound TCP port 443 is the correct NSG configuration.<\/span><\/p>\n

                                      Question 139<\/b><\/h3>\n

                                      You need to allow an Azure VM to access a storage account privately without exposing the storage account through a public endpoint. Which solution should you use?<\/b><\/p>\n

                                        \n
                                      1. Private Endpoint<\/span><\/li>\n
                                      2. Public IP<\/span><\/li>\n
                                      3. Azure Load Balancer<\/span><\/li>\n
                                      4. Azure Traffic Manager<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 1<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        A Private Endpoint creates a private network interface with a private IP address inside a virtual network for accessing supported Azure services. When configured for a storage account, applications can access the service privately while reducing exposure through its public endpoint. A Public IP provides internet-facing connectivity, Load Balancer distributes traffic, and Traffic Manager provides DNS-based traffic routing. Therefore, a Private Endpoint is the appropriate solution when an Azure VM must access a storage account through private connectivity.<\/span><\/p>\n

                                        Question 140<\/b><\/h3>\n

                                        You need to move an Azure virtual machine and its related resources from one resource group to another within the same subscription. Which Azure capability should you use?<\/b><\/p>\n

                                          \n
                                        1. Resource Move<\/span><\/li>\n
                                        2. Azure Backup<\/span><\/li>\n
                                        3. Azure Policy<\/span><\/li>\n
                                        4. Azure Advisor<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          Azure Resource Move allows supported resources to be moved between resource groups or subscriptions while maintaining their configurations when the move is supported. Before moving resources, dependencies and service-specific limitations should be checked. Azure Backup is used for data protection, Azure Policy enforces governance requirements, and Azure Advisor provides recommendations. Therefore, Resource Move is the appropriate capability for relocating a supported virtual machine and its associated resources from one resource group to another.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full\u00a0Microsoft AZ-104 Exam Dumps\u00a0and Practice Test Dumps.   Question 121 You need to assign permissions to a user so they can manage Azure virtual machines but cannot modify networking resources. Which Azure RBAC role should you consider? Virtual Machine Contributor Owner Reader Network Contributor Correct Answer: 1 Explanation The Virtual Machine Contributor role allows […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11781"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=11781"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11781\/revisions"}],"predecessor-version":[{"id":11782,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/11781\/revisions\/11782"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=11781"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=11781"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=11781"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}