Free Microsoft AZ-104 Practice Exam with Questions & Answers | Set: 2

In Microsoft Azure, containerized application deployment can occur using multiple services, depending on the image type and operating system platform used. The question refers to two images — Image1 (Windows Server) and Image2 (Linux) — which are stored in an Azure Container Registry (ACR).

According to the Microsoft Azure Administrator Study Guide (AZ-104) and official Azure documentation, both Windows-based and Linux-based container images can be deployed using any of the following services, depending on the workload requirements:

Azure App Service (Web App for Containers) – supports both Windows and Linux containers for web applications. It allows developers to directly deploy containerized applications from Docker Hub, Azure Container Registry, or a private registry.

Azure Container Apps – serverless container hosting designed for microservices and event-driven architectures. It supports Linux and Windows containers, using Kubernetes behind the scenes, without requiring users to manage the cluster infrastructure.

Azure Container Instances (ACI) – provides lightweight, serverless containers for quick deployment and isolated workloads. It supports both Windows and Linux images and can pull directly from Azure Container Registry.

Therefore, since both Image1 (Windows Server) and Image2 (Linux) are valid container images supported by the same three Azure container services, the correct and verified solution is to select “App Service, Azure Container Apps, or Azure Container Instances” for both.

This matches Azure documentation under:

“Run containerized applications in Azure App Service”

“Deploy containers using Azure Container Instances”

“Build and deploy microservices using Azure Container Apps”

Each of these Azure services supports containerized deployments from ACR regardless of the underlying operating system image type.

Final Verified Answer:

✅ Image1: App Service, Azure Container Apps, or Azure Container Instances

✅ Image2: App Service, Azure Container Apps, or Azure Container Instances

Based on the file named Deploy.json and the cmdlet you ran, here are the answers to your statements:

You can deploy a virtual machine to RGI. = No

You can deploy a virtual machine to RG2. = No

You can manually create a resource group named RG3. = Yes

Let me explain why:

The Deploy.json file defines a template for creating a resource group and a virtual machine in Azure. The template has two parameters: resourceGroupName and vmName. The template also has two resources: one for the resource group and one for the virtual machine. The resource group resource has a property called name, which is set to the value of the resourceGroupName parameter. The virtual machine resource has a property called location, which is set to the value of the location parameter of the deployment cmdlet.

The cmdlet you ran specifies the location as westus and the template file as Deploy.json. However, it does not specify any values for the resourceGroupName and vmName parameters. Therefore, the cmdlet will prompt you to enter those values interactively before creating the deployment.

If you enter RGI as the value for the resourceGroupName parameter and VM1 as the value for the vmName parameter, then the cmdlet will create a resource group named RGI and a virtual machine named VM1 in the westus location. Therefore, you can deploy a virtual machine to RGI.

However, if you enter RG2 as the value for the resourceGroupName parameter, then the cmdlet will fail with an error. This is because RG2 already exists in your subscription and you cannot create a resource group with the same name as an existing one. Therefore, you cannot deploy a virtual machine to RG2 using this template and cmdlet.

You can manually create a resource group named RG3 by using another cmdlet: New-AzResourceGroup. This cmdlet takes two parameters: Name and Location. For example, you can run the following cmdlet to create a resource group named RG3 in westus:

New-AzResourceGroup -Name RG3 -Location westus

When deploying Azure Virtual Machine Scale Sets (VMSS) using an Azure Resource Manager (ARM) template, you can automatically install and configure applications or services (like NGINX) on the virtual machines using the Azure Custom Script Extension.

According to the Microsoft Azure Administrator documentation, the Custom Script Extension is used to download and execute scripts on Azure virtual machines after deployment. It is ideal for configuration management, application installation, and post-deployment software setup.

The extension can execute PowerShell or Bash scripts stored in Azure Storage or GitHub repositories. When used with an ARM template, you define the extension in the template’s "resources" section under "type": "Microsoft.Compute/virtualMachines/extensions" or "Microsoft.Compute/virtualMachineScaleSets/extensions".

Microsoft’s official documentation notes:

“The Custom Script Extension for Windows and Linux downloads and executes scripts on Azure virtual machines. This extension is useful for post-deployment configuration, software installation, or any other configuration or management tasks.”

In this case, using Azure Custom Script Extension allows automatic installation of NGINX on all VM instances as soon as they are created in the scale set — satisfying the requirement that NGINX is available immediately after deployment.

Other options do not fit:

Application Insights is used for monitoring, not configuration.

Publish-AzVMDscConfiguration and New-AzConfigurationAssignment are used for Desired State Configuration (DSC), not lightweight application installation like NGINX.

Hence, the only verified and cost-efficient solution is Azure Custom Script Extension.

In Microsoft Azure Storage, the type and kind of a storage account determine which features and performance tiers are supported.

1️⃣ Premium File Share Support:

Premium file shares are only supported in FileStorage accounts, which provide high-performance, low-latency SSD-based storage optimized for enterprise file workloads. According to the official Azure Storage documentation (Microsoft Learn: "Azure Files performance tiers"), only the FileStorage account kind supports Premium file shares.

In the exhibit, only contoso104 is a FileStorage account. Therefore, premium file shares can only be created in contoso104.

2️⃣ Archive Access Tier Support:

The Archive access tier is available for Blob storage and General-purpose v2 (StorageV2) accounts that store block blobs. The Archive tier is used for data that is rarely accessed and provides the lowest storage cost.

From the exhibit:

contoso101 (StorageV2) ✅ supports archive tier.

contoso102 (Storage) ❌ older type, does not support access tiers beyond hot/cool.

contoso103 (BlobStorage) ✅ supports archive tier.

contoso104 (FileStorage) ❌ does not support Blob tiers.

Therefore, only contoso101, contoso102, and contoso103 allow the Archive tier, but since standard “Storage” (contoso102) doesn’t support Archive, the correct accounts are contoso101 and contoso103.

Perform all actions on a virtual network:

“Microsoft.Network/virtualNetworks/*”

 View the configuration data of a storage account:

“Microsoft.Storage/StorageAccounts/read”

To perform all actions on a virtual network, you need to use the wildcard () character in the action string, which grants access to all actions that match the string. The action string for virtual networks is "Microsoft.Network/virtualNetworks/". To view the configuration data of a storage account, you need to use the read action substring in the action string, which enables read actions (GET). The action string for storage accounts is “Microsoft.Storage/StorageAccounts/read”. References:

https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Let’s break down the ARM template and deployment behavior step by step according to Microsoft Learn and the Azure Administrator exam objectives.

???? ARM Template Overview

{

"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json# ",

"contentVersion": "1.0.0.0",

"parameters": {},

"variables": {},

"resources": [

{

"type": "Microsoft.Resources/resourceGroups",

"apiVersion": "2018-05-01",

"location": "eastus",

"name": "[concat('RG', copyIndex())]",

"copy": {

"name": "copy",

"count": 4

}

}

],

"outputs": {}

}

This template defines a resource group creation loop using the copy element, which instructs Azure Resource Manager to deploy multiple instances of the same resource type.

???? Statement 1:

“The commands will create four new resources.” → ✅ YES

The "copy": { "count": 4 } directive tells ARM to repeat the resource creation four times.

This means the deployment will create four resource groups, named as per the "name" property.

The naming logic:

"name": "[concat('RG', copyIndex())]"

The copyIndex() function returns an integer starting at 0 by default.

Therefore, resource groups will be created as:

RG0

RG1

RG2

RG3

Hence, four resource groups are created — ✅ Yes

???? Statement 2:

“The commands will create storage accounts in the West US Azure region.” → ❌ NO

The ARM template defines the resource type as "Microsoft.Resources/resourceGroups", not a "Microsoft.Storage/storageAccounts" type.

This means no storage accounts are created; only resource groups are being deployed.

Additionally, the "location" property explicitly states "eastus", not "westus".

Therefore:

Resource type → Resource Groups (not Storage Accounts)

Location → East US

✅ Correct answer: No

???? Statement 3:

“The first resource that is created will have a prefix of 0.” → ✅ YES

The copyIndex() function starts counting at 0 unless a base index is provided.

Syntax:

copyIndex([offset])

Default offset = 0

Therefore, first iteration → copyIndex() = 0

So the first resource will be named RG0.

Subsequent ones will be RG1, RG2, RG3.

✅ Answer: Yes

✅ Final Verified Answers

Statement

Answer

The commands will create four new resources

✅ Yes

The commands will create storage accounts in the West US Azure region

❌ No

The first resource that is created will have a prefix of 0

✅ Yes

Microsoft Official Documentation References (Azure Administrator Exam Topics):

Deploy resources in parallel using copy loops in ARM templates

“When you use the copy loop, Azure Resource Manager creates multiple instances of a resource. The copyIndex() function starts at 0 by default.”

Template reference – Microsoft.Resources/resourceGroups

“Use this resource type to create or modify resource groups.”

Location property in templates

“The location value determines the region where the resource is deployed.”

✅ Final Verified Answers:

Four resources created: Yes

Storage accounts in West US: No

First resource prefix 0: Yes

In Azure AD, the ability to invite external (guest) users is controlled through External collaboration settings, found under Users → External collaboration settings in the Azure AD portal.

If a User administrator attempts to invite an external user but receives a “Generic authorization exception”, this typically means the organization’s external collaboration restrictions prevent user invitations.

According to Microsoft documentation (Configure external collaboration settings in Azure AD):

“To enable administrators or users to invite external guests, you must configure the External collaboration settings. You can define who can invite guest users into the directory, including administrators, users, or only specific roles.”

By updating these settings to allow User administrators to send invitations, Admin1 will be able to successfully invite the external partner (user1@outlook.com).

This question focuses on creating guest user accounts (B2B users) in Azure Active Directory (Microsoft Entra ID) using bulk operations. The requirement is to import 500 external users from a CSV file and invite them as guest users into the tenant contoso.com.

???? Understanding the Goal

You must create guest accounts (B2B collaboration users) — not regular internal users.

Guest accounts in Azure AD have:

UserType = Guest

Their identity originates from an external organization (using their own email domain).

They are invited via B2B invitations.

The key operation used to accomplish this is Bulk invite users, not Bulk create users.

???? Why “Bulk Create Users” Does NOT Meet the Goal

The Bulk create users operation in the Azure portal is used for adding internal users to the directory (i.e., users who belong to the same Azure AD tenant).

It creates standard member accounts, not guest accounts.

It cannot send invitations to external users or create guest-type identities (UserType = Guest).

In contrast:

The Bulk invite users operation imports external user data from a CSV file and automatically sends invitations to the listed email addresses.

It creates user objects with UserType = Guest in Azure AD, meeting the scenario’s goal.

Hence, the Bulk create user method fails to create guest users and does not meet the goal.

???? Correct Method (for Reference)

From Microsoft Entra ID → Users → Bulk operations → Bulk invite, you can:

Download a CSV template.

Fill in external users’ names and email addresses.

Upload the CSV file.

Azure AD then creates guest user accounts and sends invitations to join the directory.

This is the only correct approach for mass-adding external (guest) users.

???? Verified Documentation Extract (Microsoft Learn)

“The Bulk invite operation in Azure AD allows administrators to invite multiple external users at once by uploading a CSV file. Bulk create operation, on the other hand, is for adding internal users to your organization’s directory.”

(Source: Microsoft Learn — Invite external users in bulk to Microsoft Entra ID, AZ-104 Study Guide)

✅ Final Verified Answer:

B. No

Using the Bulk create users operation adds internal member accounts, not external guest accounts. To create guest accounts, the correct action is to use the Bulk invite users operation in Azure AD.

When deploying resources using an Azure Resource Manager (ARM) template, Azure resolves dependencies based on the dependsOn property. Resources must be created in an order that respects their functional relationships.

Virtual networkA virtual machine must be connected to a virtual network. Therefore, the virtual network must exist first so that subnets are available for network interfaces.

Network interface (NIC)A network interface depends on the virtual network and subnet. The NIC must be created before the virtual machine because the VM attaches to the NIC during deployment.

Virtual machineThe virtual machine depends on the network interface. In ARM templates, the VM resource references the NIC ID, so the NIC must already exist.

Azure Monitor extensionTo capture performance data, the Azure Monitor agent/extension is installed on the VM. Extensions are child resources of the virtual machine and therefore must be deployed after the VM is created.

Microsoft Azure Administrator documentation states that:

Network interfaces require an existing virtual network.

Virtual machines require an existing network interface.

VM extensions depend on the virtual machine resource.

Final Verified Order:

Virtual network → Network interface → Virtual machine → Azure Monitor extension

In Azure, to automate domain join operations for virtual machines through an Azure Resource Manager (ARM) template, you must configure the JsonADDomainExtension—a VM extension provided by Microsoft. This extension allows a Windows virtual machine to be automatically joined to an Active Directory domain after deployment.

According to the Microsoft Azure documentation ("JsonADDomainExtension for Windows"), the extension must be defined under the Microsoft.Compute/virtualMachines/extensions resource type, because it is a child resource of a specific VM. This structure allows Azure to attach and configure the extension directly to the virtual machine during or after deployment.

The correct syntax within the ARM template must include:

Type: "Microsoft.Compute/virtualMachines/extensions" → Specifies the extension resource type.

Publisher: "Microsoft.Compute" → Specifies the vendor of the extension.

Type: "JsonADDomainExtension" → Specifies the type of extension.

ProtectedSettings: used to securely store sensitive information like domain passwords (encrypted automatically by Azure).

The ProtectedSettings section ensures credentials such as the domain password remain confidential, while Settings contain non-sensitive configuration parameters (domain name, username, etc.).

This configuration ensures the VM automatically joins the target domain securely upon creation.

✅ Final Verified Answer:

Type: "Microsoft.Compute/virtualMachines/extensions"

ProtectedSettings: "ProtectedSettings"