How many Troubleshooting Scenario Questions questions are on this page?

This page has 7 Troubleshooting Scenario Questions scenario questions for the AZ-104 exam, each with detailed explanations and wrong-answer analysis.

How should I approach AZ-104 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AZ-104 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AZ-104 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

AZ-104

exam code

Microsoft

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1mediummatching

Full question →

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

The priority 100 rule is evaluated first, so it wins if both rules match the same traffic.

It controls traffic entering the subnet or NIC from another network location.

It filters traffic for a single VM and can be used in addition to a subnet NSG.

It matches any ephemeral source port and does not limit the sender's port selection.

It allows only HTTPS traffic that uses TCP and the specified destination port.

A
NSG: A distributed firewall that filters traffic based on rules.
An NSG is a distributed firewall implemented by Azure's host networking layer, not a physical or virtual appliance. It filters inbound and outbound traffic based on priority-ordered security rules, each specifying source/destination, protocol, and port ranges. NSGs can be associated with a subnet, a NIC, or both, and are stateful, meaning that allowing inbound traffic automatically permits the corresponding outbound return traffic. This makes it the primary control for permitting or denying inbound connections to a VM.
B
Default inbound rule: Allows all inbound traffic by default.
Why wrong: Default inbound rules in an NSG actually deny all inbound traffic by default, not allow it. The built-in 'DenyAllInBound' rule with the lowest priority ensures that any inbound traffic not matched by a higher-priority allow rule is blocked. There are also default allow rules for virtual network traffic and Azure Load Balancer health probes, but these are exceptions to the default deny posture. You must explicitly create an allow rule with a priority number lower than the deny rule (i.e., a higher priority) to let traffic reach the VM.
C
UDR: Overrides the default system route and can redirect traffic to a network virtual appliance.
A User Defined Route (UDR) is an explicit route entry in a route table that takes precedence over Azure's system routes for matching traffic. When attached to a subnet, UDRs can redirect outbound or inbound traffic that transits the subnet to a network virtual appliance (NVA) by setting the next hop type to 'Virtual Appliance' and specifying its private IP address. This is commonly used to force traffic through firewalls or IDS/IPS for inspection. However, a UDR does not open or block ports; it only changes the path traffic takes, so an NSG is still needed to actually filter that traffic.
D
ASG: Groups VMs logically to simplify NSG rule management.
An Application Security Group (ASG) is an Azure resource that groups VM network interfaces logically based on workload, such as 'web servers' or 'database servers', rather than by subnet or IP address. In NSG rules, you can reference an ASG as the source or destination, and the rule automatically applies to any VM NIC that is added to or removed from the group. This eliminates the need to update individual NSG rules when IP addresses change and reduces rule management overhead. Note that ASGs are not a firewall or security service; they are purely an organization and targeting construct for NSG rules.
E
Service tags: Override default system routes.
Why wrong: Service tags are groups of Azure service IP prefixes, such as 'Storage' or 'AzureLoadBalancer', that you can use as source or destination in NSG rules to allow or deny traffic for an Azure service without hard-coding IP addresses. They represent a collection of IP ranges, not a routing capability; they do not override default system routes. Route overriding is performed exclusively by User Defined Routes (UDRs) in route tables, not by service tags. Thus, using a service tag in an NSG might filter traffic, but it will never change the next hop or the path traffic takes.

Full breakdown with real-world context →

Question 2hardmulti select

Full question →

VM-App01 is responding slowly and appears to be on a degraded Azure host. You must keep the VM resource, keep its disks and NIC, and move it to fresh infrastructure before further troubleshooting. Which two actions can achieve that goal? Select two.

A
Redeploy the VM.
Redeploying a VM is an Azure-specific recovery operation that releases the current host node and re-provisions the VM onto a new healthy node, while preserving the VM object, managed disks, NIC, and IP addresses. This is the most direct remediation when the underlying physical host is suspected of causing performance degradation, because a simple restart keeps you on the same problematic host. Azure's redeploy API performs a controlled shutdown, migrates the VM's state, and boots it on fresh infrastructure, so it is the correct first step for host-related health issues.
B
Delete the VM and recreate it from the OS disk.
Why wrong: Deleting a VM and attempting to recreate it from its OS disk is a destructive manual process that removes the VM resource, its NIC, public IP, and availability/extensions configuration; during the delete, the attached managed OS disk is typically retained only if explicitly kept, and reassociating it to a new VM requires re-creating all network and role settings from scratch. This is far more risky and time-consuming than redeploy or deallocate, and it unnecessarily exposes your workload to misconfiguration or accidental data loss. It does not address the underlying host health concern in a controlled way and should be avoided for a simple host-level performance issue.
C
Capture the VM into a generalized image.
Why wrong: Capturing a generalized image is a template-creation operation: it runs a generalization process (such as Sysprep for Windows or `waagent -deprovision` for Linux) that strips the VM of unique identifiers and user-specific configuration, then saves the disks as an image. This is inappropriate for troubleshooting a degraded VM because it converts the running system into a reusable template rather than restoring it to a healthy state, and the original VM cannot continue operation after generalization. It is a heavy, irreversible step that changes the VM's identity and requires creating new VMs from the image, so it does not address an unhealthy host.
D
Stop/deallocate the VM.
Stopping and deallocating a VM powers off the instance and explicitly releases the compute lease on the current host, causing Azure to return the VM's resources to the pool while keeping the VM record, OS/managed disks, and NIC intact. When you start the VM again, Azure places it on a new host (potentially after a delay), which can resolve host-level performance issues. However, this requires an explicit start action and may result in losing dynamic public IP reassignment if not using a static IP, making redeploy a more efficient one-step recovery.
E
Convert the VM to an availability set.
Why wrong: Converting a VM to an availability set is not an operational recovery action and is not even directly supported for an existing VM—you must create the availability set separately and then add the VM to it, which physically moves the VM into a different fault/update domain but does not necessarily trigger a new host placement or resolve current degradation. An availability set is a deployment topology that ensures VMs are placed on different physical infrastructure for high availability, not a troubleshooting tool for a single unhealthy VM. Attempting this would require a full recreate or a complex reconfiguration with downtime, making it completely unsuitable for immediate performance triage.

Full breakdown with real-world context →

Question 3mediummatching

Full question →

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters rows so only records that meet the condition remain in the result.

Returns only selected columns and can rename them for cleaner output.

Aggregates data, such as counting failures by hour or by status code.

Adds a calculated column based on existing fields in each row.

Sorts the result set, such as showing the newest records first.

A
where: Filters results to rows matching a specified condition
'where' filters rows based on a boolean expression, keeping only those rows for which the predicate evaluates to true. It operates row-by-row and supports standard comparison operators (=, !=, >, <), string operators (has, startswith), and logical combinations (and, or, not). This operator reduces the number of rows in the result set but does not alter columns or perform any aggregation, making it essential for scoping investigations to a specific time range or error code.
B
project: Selects a subset of columns
'project' explicitly defines the shape of the output by selecting a subset of existing columns, optionally renaming them or creating new computed columns inline. It reduces the result set's column count and can also reorder columns, but it does not change the number of rows. In investigations, project is used to narrow down the fields of interest after filtering with where, so analysts can focus on relevant attributes without carrying unnecessary data.
C
summarize: Aggregates data by groups with aggregation functions
'summarize' groups rows by one or more key columns and computes aggregate values (count, sum, avg, min, max, dcount, etc.) for each group. It collapses the input into a new table with one row per distinct combination of group keys, and you can apply multiple aggregation functions in a single summarize clause. Unlike where, it does not preserve individual rows; it transforms the data into statistical summaries, which is useful for quantifying failed operations by error type or resource.
D
extend: Filters results to rows matching a specified condition
Why wrong: 'extend' adds one or more new computed columns to the result set with expressions evaluated per row, keeping all existing rows and columns intact. It does not filter rows based on a condition; filtering is exclusively the role of the where operator, which evaluates a boolean predicate. Confusing extend with where would cause the query to produce the same row count but with extra columns, failing to narrow the data for investigation.
E
join: Adds computed columns to the result set
Why wrong: 'join' merges rows from two tabular inputs by matching values in specified key columns, producing a combined result set with columns from both sides. It does not add computed columns to an existing table; that operation belongs to extend, which calculates new fields row-by-row without combining tables. A join can change both row count and column count depending on the join type (inner, leftouter, etc.) and is typically used to enrich logs with metadata from external tables.
F
order by: Groups data and applies aggregation
Why wrong: 'order by' sorts the result set by one or more columns or expressions in ascending or descending order, affecting only the sequence of rows, not their contents or count. It neither groups data nor applies aggregation functions; grouping and aggregation are performed by summarize, which collapses multiple rows into summary rows. Placing order by before summarize would sort the raw rows but then summarize would discard that ordering when it groups the data, so order by is normally applied last in a query.

Full breakdown with real-world context →

Question 4easymulti select

Full question →

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

A
Activity log entries
The Azure activity log is a subscription-level platform log that records every control-plane write operation, including create, update, and delete actions. Each entry contains the caller identity (user or service principal), timestamp, operation name, resource ID, and status, which directly answers 'who changed a resource.' It is automatically retained for 90 days and can be sent to a Log Analytics workspace for longer-term querying and alerting.
B
Resource diagnostic logs
Resource diagnostic logs are internal, service-specific logs emitted by an Azure resource, such as application logs, performance counters, or workflow traces. They capture data-plane activity about how a resource operates, not the identity of a user who issued an ARM change, and they are disabled by default until you configure a diagnostic setting. While useful for root-causing operational issues, they do not provide the caller information needed to determine who modified a resource.
C
Azure Backup vault names
Why wrong: A Recovery Services vault name is merely an Azure Resource Manager identifier assigned to a backup vault's configuration. It is not a log stream, metric, or queryable audit artifact, so it cannot reveal historical operations or roles that performed changes. Backup jobs themselves are recorded in the Activity log, but the vault name alone contains no telemetry about who changed any resource.
D
Virtual network address spaces
Why wrong: Virtual network address spaces define the IP CIDR ranges assigned to a vNet and are stored as a property of the network resource. These values are configuration data, not event records, and querying them returns only the current address plan, never the identity of the person who modified it. Any change to an address space is captured by the Activity log as a separate write event, but the address space setting itself cannot be used for forensic analysis.
E
Managed disk size settings
Why wrong: Managed disk size settings describe the current allocated capacity of a disk, such as 128 GiB, and are part of the resource's configuration state. Although resizing a disk generates an Activity log entry, the size value itself is a property, not a log record, and cannot be queried to show who performed the operation. Therefore, examining disk size in Log Analytics would provide only current configuration, not a change history or caller identity.

Full breakdown with real-world context →

Question 5hardmultiple choice

Full question →

A Windows VM fails to start after a configuration change. You need to capture screenshots and serial console output to troubleshoot the boot problem. Which feature should you use?

A
Azure Backup
Why wrong: Azure Backup protects against data loss by creating snapshots and recovery points that can restore the entire VM or individual files. While restoring an earlier backup could revert the VM to a working state, it does not explain the specific cause of the boot failure and may take considerable time and effort. Backup is a disaster recovery option, not a live troubleshooting mechanism for boot diagnostics.
B
Boot diagnostics
Boot diagnostics is the correct tool because it captures the VM's serial console output and screenshots during startup, which can reveal exactly where the boot process halts after the configuration change. This helps identify misconfigured services, missing drivers, or corrupt boot files. Unlike other options, it directly provides actionable boot-time logs without requiring access to the VM.
C
Just-in-Time VM access
Why wrong: Just-in-Time (JIT) VM access only manages temporary RDP or SSH port exposure through Azure Security Center, using NSG rules to reduce attack surface. It does not capture or retrieve any boot logs, screenshots, or serial console data, so it cannot help identify why a configuration change prevented the Windows VM from starting. JIT is a security control, not a diagnostic tool.
D
Autoscale
Why wrong: Autoscale scales out or in the number of VM instances based on performance metrics like CPU or queue length, and it applies only to Virtual Machine Scale Sets. A single Windows VM does not use autoscale for boot failure diagnosis, and autoscale provides no insight into boot errors or configuration issues. It is completely unrelated to troubleshooting a startup failure.

Full breakdown with real-world context →

Question 6hardmultiple choice

Full question →

You create a private endpoint for an Azure Storage account and disable public network access on the account. A VM in a peered VNet cannot reach the storage account by name. The private endpoint resides in VNet-App. What is the most likely missing configuration?

A
A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IP
A private endpoint allocates a private IP from the VNet subnet, but the storage account's public FQDN still resolves to its public IP unless you override resolution. Linking a private DNS zone (e.g., privatelink.blob.core.windows.net) to the VNet and creating an A record for the endpoint makes the storage account name resolve to the private IP. This DNS integration is the essential companion to the private endpoint, and without it clients in the VNet would keep bypassing the endpoint.
B
An NSG rule allowing outbound DNS to 8.8.8.8
Why wrong: Configuring an NSG rule that permits outbound DNS to 8.8.8.8 targets a public resolver, which has no record for the storage account's private endpoint and would return the public IP address. Private endpoint name resolution requires Azure DNS or a DNS server that forwards to Azure's internal resolver (168.63.129.16) and has access to the private DNS zone. Allowing public DNS simply fails to map the FQDN to the endpoint's private IP, so it cannot correct the connectivity issue.
C
A Recovery Services vault in the peered VNet
Why wrong: Recovery Services vaults are backup and disaster-recovery constructs; they do not participate in VNet name resolution or private endpoint routing. Placing one in a peered VNet neither creates a private IP mapping for the storage account nor links a DNS zone to your client's VNet. The storage account's public DNS record remains untouched, so application traffic would still leave the VNet over the public endpoint instead of using the private endpoint.
D
A public IP address on the private endpoint NIC
Why wrong: A private endpoint NIC is designed to carry only a private IP from the subnet in which it is provisioned; attaching a public IP would directly violate this isolation model and negate the security purpose of the endpoint. Azure does not support assigning a public IP to a private endpoint's network interface, as the whole feature exists to ensure traffic stays within the private address space. Any attempt to make the endpoint publicly reachable would break the connectivity model rather than fix DNS resolution.

Full breakdown with real-world context →

Question 7hardmultiple choice

Full question →

Users on the internet cannot reach an HTTPS application hosted on VM-Web01. The VM has a public IP address, the application is listening on TCP port 443, and the guest OS firewall allows the traffic. What is the most likely Azure-side cause?

A
The NSG blocks inbound TCP 443
Network Security Groups (NSGs) filter inbound and outbound traffic at the subnet or network interface level using priority-ordered allow/deny rules. HTTPS traffic uses TCP port 443, so if the NSG attached to the VM's subnet or NIC has no explicit rule allowing inbound TCP 443, the default-deny behavior of the NSG will silently drop those connection attempts. Even if the VM itself is healthy and listening on port 443, the NSG acts as a stateful firewall that controls what traffic can even reach the VM's network stack. An explicit deny rule or missing allow rule for TCP 443 is therefore the most direct and common cause of internet users being unable to reach an HTTPS application.
B
The VM uses Premium SSD
Why wrong: Premium SSD is a storage tier that provides higher IOPS, throughput, and lower latency for disk operations compared to Standard HDD/SSD. It affects the performance of reads and writes to the virtual machine's managed disks, such as the OS disk or data disks, but it has absolutely no effect on the network path between internet users and the VM. Inbound HTTPS traffic is governed by network-level components like public IP configuration, load balancers, and NSGs, not by the performance characteristics of the underlying disk. Even if the web application is slow due to disk I/O, that would manifest as slow response times, not as total unreachability from the internet.
C
Azure Backup is not enabled
Why wrong: Azure Backup is a service that protects VMs by taking scheduled snapshots and replicating them to a Recovery Services vault for point-in-time restore. It operates in the control plane and performs backup operations via the Azure fabric; it does not alter the VM's networking configuration, operating system firewall, or NSG rules. When you enable backup, it does not add any inbound endpoints or change the VM's public/private IP addressing. Therefore, the absence of an Azure Backup configuration cannot cause internet users to lose connectivity to an HTTPS application—it only means the VM lacks a disaster recovery data protection policy.
D
The storage account uses GRS
Why wrong: Geo-redundant storage (GRS) is a storage account replication setting that asynchronously copies data to a paired secondary region for high availability and disaster recovery. It is purely a data durability feature for Blob, File, Queue, and Table storage, and it has no relation to network access to a separate virtual machine. Unless the HTTPS application is hosted as a static website from a storage account, which is not the case here since it is an application on a VM, GRS would not influence inbound TCP 443 traffic. The storage account's redundancy setting does not modify any network security rules, DNS resolution, or routing that would block or allow web traffic.

Full breakdown with real-world context →

These AZ-104 practice questions are part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style AZ-104 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related AZ-104 topic practice pages

Manage Azure Identities and Governance practice questions

Implement and Manage Storage practice questions

Deploy and Manage Azure Compute practice questions

Implement and Manage Virtual Networking practice questions

Monitor and Maintain Azure Resources practice questions

AZ-104 Azure RBAC practice questions

AZ-104 storage account practice questions

AZ-104 virtual network practice questions

AZ-104 NSG practice questions

AZ-104 Azure Monitor practice questions

AZ-104 backup practice questions

AZ-104 managed identity practice questions

Practice scenarios

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

VM-App01 is responding slowly and appears to be on a degraded Azure host. You must keep the VM resource, keep its disks and NIC, and move it to fresh infrastructure before further troubleshooting. Which two actions can achieve that goal? Select two.

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

A Windows VM fails to start after a configuration change. You need to capture screenshots and serial console output to troubleshoot the boot problem. Which feature should you use?

You create a private endpoint for an Azure Storage account and disable public network access on the account. A VM in a peered VNet cannot reach the storage account by name. The private endpoint resides in VNet-App. What is the most likely missing configuration?

Users on the internet cannot reach an HTTPS application hosted on VM-Web01. The VM has a public IP address, the application is listening on TCP port 443, and the guest OS firewall allows the traffic. What is the most likely Azure-side cause?