Microsoft Azure Administrator (AZ-104) — All Questions

You need to grant a support engineer the ability to reset passwords and manage user accounts in Microsoft Entra ID, but not manage Azure resources like virtual machines. Which type of role assignment is appropriate?

• a.An Azure RBAC role such as Contributor at the subscription scope
• b.An Azure RBAC role such as Owner at the resource group scope
• c.A Microsoft Entra role such as User Administrator✓
• d.A custom Azure Policy definition assigned to the tenant

Microsoft Entra roles (like User Administrator) control access to Entra ID resources such as users, groups, and directory settings. Azure RBAC roles (Contributor, Owner) control access to Azure resources like VMs and storage, which is not what is needed here. The two role systems are separate, so managing directory objects requires an Entra role, not an RBAC assignment.

Your organization requires that no resource in the Production resource group can be accidentally deleted, but administrators must still be able to modify existing resources. Which resource lock should you apply?

• a.A ReadOnly lock on the subscription
• b.A CanNotDelete lock on the resource group✓
• c.A ReadOnly lock on the resource group
• d.A CanNotDelete lock combined with a ReadOnly lock

A CanNotDelete lock prevents deletion of resources while still allowing reads and modifications. A ReadOnly lock would block modifications too, which the requirement forbids. Locks applied at the resource group level are inherited by all resources within it.

You want to automatically enforce that every new storage account created in a subscription uses only the East US region. Which Azure governance feature should you use?

• a.Azure Policy with a deny effect on the location field✓
• b.A resource lock set to ReadOnly
• c.An Azure RBAC custom role that restricts regions
• d.A tag applied to the subscription

Azure Policy evaluates resources against rules and can use a deny effect to block creation of resources that do not meet conditions, such as an allowed-locations restriction. Resource locks and RBAC control who can act and whether resources can be deleted, but they cannot enforce property values like region. Tags are metadata and do not enforce anything by themselves.

You have several subscriptions and want to apply a single Azure Policy and consistent RBAC assignments across all of them at once. What should you use to organize the subscriptions?

• a.A single resource group containing all subscriptions
• b.Tags applied to each subscription
• c.A Recovery Services vault
• d.A management group containing the subscriptions✓

Management groups sit above subscriptions and let you apply policies and RBAC assignments that are inherited by all subscriptions within them. Resource groups exist inside a subscription and cannot contain subscriptions. Tags provide metadata but do not push governance settings down a hierarchy.

You need to group multiple users so you can assign an Azure RBAC role to all of them at once, and the membership should update automatically based on a user's department attribute. Which option should you configure?

• a.An assigned (static) security group
• b.A dynamic security group in Microsoft Entra ID✓
• c.A Microsoft 365 group with manual membership
• d.A management group

A dynamic security group uses membership rules based on user attributes (such as department), so users are added or removed automatically as their attributes change. Assigned groups require manual membership management. You can then assign an RBAC role to the group so all members inherit the access.

You need storage redundancy that keeps your data available even if an entire Azure region experiences a disaster, and you want the secondary copy in a geographically distant region. Which redundancy option meets this requirement at the lowest option that qualifies?

• a.Locally redundant storage (LRS)
• b.Zone-redundant storage (ZRS)
• c.Geo-redundant storage (GRS)✓
• d.Read-access geo-redundant storage (RA-GRS)

GRS replicates data to a secondary region hundreds of miles away, protecting against a full regional outage. LRS keeps three copies in one datacenter and ZRS spreads copies across zones in a single region, so neither survives a regional disaster. RA-GRS also protects against regional failure but additionally allows read access to the secondary, which exceeds the stated need.

You must give an external partner temporary, time-limited read access to a single blob container without sharing your storage account keys. What should you generate?

• a.A shared access signature (SAS) scoped to the container✓
• b.A new storage account access key
• c.A Microsoft Entra service principal with Owner rights
• d.A CanNotDelete resource lock

A shared access signature (SAS) provides delegated access with a defined expiry time, specific permissions, and a limited scope such as a single container, without exposing account keys. Sharing an account key grants full access with no expiry. A service principal with Owner would grant far more than temporary read access.

Log files in a blob container are rarely accessed after 30 days but must be retained. You want to reduce storage cost automatically. What should you configure?

• a.Change the account redundancy from GRS to LRS
• b.Manually move blobs to a different storage account each month
• c.Enable soft delete on the container
• d.A lifecycle management policy that moves blobs to the Cool or Archive tier after 30 days✓

A blob lifecycle management policy can automatically transition blobs to the Cool or Archive access tier based on the last-modified time, lowering cost for infrequently accessed data. Soft delete protects against accidental deletion but does not reduce cost. Changing redundancy affects durability, not tiering, and manual moves are error-prone.

You want to copy a large number of files from an on-premises server to Azure Blob Storage efficiently from the command line, with high throughput and resume support. Which tool is designed for this?

• a.Azure Bastion
• b.AzCopy✓
• c.Azure Policy
• d.Network Watcher

AzCopy is a command-line utility optimized for high-performance, resumable bulk data transfer to and from Azure Blob and File storage. Azure Bastion provides secure RDP/SSH to VMs, and Network Watcher and Azure Policy serve networking diagnostics and governance respectively, not data copy.

A VM cannot reach a backend server on a specific port, and you need to determine whether an NSG rule is blocking the traffic and identify which rule. Which Network Watcher tool should you use?

• a.Connection monitor over a 30-day period
• b.IP flow verify✓
• c.A metric alert rule on the VM
• d.A Recovery Services vault restore point

IP flow verify checks whether a packet to or from a VM is allowed or denied and names the specific NSG security rule responsible, making it ideal for pinpointing a blocking rule. Connection monitor tracks connectivity and latency over time but does not identify the exact rule instantly. Metric alerts and vault restore points are unrelated to NSG traffic diagnostics.

You are deploying two VMs that must remain available if a single Azure datacenter (physical location) fails, and you want the strongest infrastructure-level protection within one region. How should you deploy them?

• a.Across multiple availability zones✓
• b.In a single availability set
• c.In the same proximity placement group
• d.On a single VM with Premium SSD disks

Availability zones are physically separate datacenters within a region, so spreading VMs across zones protects against the failure of an entire datacenter. Availability sets only protect against rack-level (fault domain) and update failures within one datacenter. A proximity placement group reduces latency but does not add fault isolation, and a single VM has no redundancy.

Your web application experiences fluctuating traffic and you want a group of identical VMs that automatically increases or decreases instance count based on CPU load. What should you deploy?

• a.A single large VM with manual resizing
• b.An availability set of fixed VMs
• c.Azure Container Instances
• d.A virtual machine scale set with autoscale rules✓

A virtual machine scale set manages a group of identical VMs and can automatically add or remove instances based on metrics like CPU using autoscale rules. Availability sets have a fixed set of VMs and do not scale automatically. A single VM cannot scale out, and Azure Container Instances runs containers, not managed VM fleets.

You want to define your Azure infrastructure as declarative code that is native to Azure, supports idempotent deployments, and offers cleaner syntax than JSON. Which option should you use?

• a.A Bash script that calls Azure CLI commands sequentially
• b.A Bicep file deployed through Azure Resource Manager✓
• c.A manual deployment through the Azure portal
• d.A PowerShell DSC configuration

Bicep is a domain-specific language that compiles to ARM templates, providing declarative, idempotent infrastructure-as-code with simpler syntax than raw JSON ARM templates. Imperative CLI or PowerShell scripts run commands in sequence and are not declarative or inherently idempotent. Portal deployments are manual and not repeatable as code.

You need to run a single, short-lived container for a batch job without managing any orchestration or underlying VM infrastructure. Which Azure service is the simplest fit?

• a.Azure Kubernetes Service (AKS)
• b.A virtual machine scale set
• c.Azure Container Instances (ACI)✓
• d.Azure App Service

Azure Container Instances (ACI) runs individual containers quickly without provisioning or managing VMs or an orchestrator, making it ideal for simple, short-lived or burst workloads. AKS is a full Kubernetes orchestration platform that adds complexity for a single container. App Service hosts web apps, and scale sets manage VMs, not standalone containers.

You want to host a web application without managing the underlying operating system or servers, with built-in support for deployment slots and easy scaling. Which Azure service should you choose?

• a.Azure App Service✓
• b.An availability set of Windows VMs
• c.Azure Container Instances
• d.A virtual machine scale set

Azure App Service is a fully managed platform-as-a-service for hosting web apps and APIs, providing OS management, deployment slots, and scaling without server administration. VMs and scale sets are infrastructure-as-a-service that require you to manage the operating system. ACI runs containers but does not offer the web-app platform features like deployment slots.

You want to allow inbound HTTPS (TCP 443) traffic to a subnet while blocking all other inbound traffic. Which resource and configuration should you use?

• a.An application security group with no rules
• b.A network security group with an inbound allow rule for port 443 and the default deny✓
• c.A route table with a custom route to the internet
• d.Azure Bastion enabled on the subnet

A network security group (NSG) contains prioritized allow and deny rules for inbound and outbound traffic; adding an allow rule for TCP 443 permits HTTPS while the default rules deny other inbound traffic. Application security groups are used to group VM NICs for use inside NSG rules, not as standalone filters. Route tables control traffic paths, not filtering, and Bastion provides secure management access.

Two virtual networks in the same Azure region must communicate directly with low latency using the Azure backbone, without a gateway. What should you configure?

• a.A site-to-site VPN connection
• b.A VPN Gateway with VNet-to-VNet
• c.Azure DNS private zones
• d.Virtual network peering✓

Virtual network peering connects two VNets directly over the Azure backbone with low latency and high bandwidth, and it does not require a VPN gateway. A VPN Gateway VNet-to-VNet connection also links VNets but adds gateway cost and latency, making it better suited when peering is not possible or across certain scenarios. Azure DNS handles name resolution, not connectivity.

You need to distribute inbound HTTP traffic across backend VMs with URL path-based routing and web application firewall protection. Which Azure service should you use?

• a.A public Standard Load Balancer
• b.Azure Bastion
• c.Azure Application Gateway✓
• d.A VPN Gateway

Azure Application Gateway is a layer 7 (HTTP/HTTPS) load balancer that supports URL path-based routing and an optional Web Application Firewall. A Load Balancer operates at layer 4 (TCP/UDP) and cannot route based on URL paths or provide a WAF. Bastion and VPN Gateway serve management access and cross-network connectivity, not load balancing.

You want to securely connect to your Azure VMs over RDP and SSH from the Azure portal without exposing public IP addresses or opening inbound ports on the VMs. What should you deploy?

• a.Azure Bastion in the virtual network✓
• b.A public IP address on each VM with an NSG rule for RDP
• c.A VPN Gateway with point-to-site configuration
• d.Azure Application Gateway

Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal over TLS, so the VMs need no public IP and no inbound RDP/SSH ports open to the internet. Assigning public IPs and opening ports increases the attack surface. A VPN Gateway is a broader connectivity solution and Application Gateway is a load balancer, neither being the simplest secure-access answer.

You want to run custom queries against collected VM performance and log data using Kusto Query Language (KQL). Which resource stores this data for querying?

• a.A Recovery Services vault
• b.A Log Analytics workspace✓
• c.An Azure Policy initiative
• d.A storage account access tier

A Log Analytics workspace is the repository where Azure Monitor stores log and performance data, and you query it using Kusto Query Language (KQL). A Recovery Services vault stores backups and recovery points, not queryable logs. Azure Policy and storage tiers are unrelated to log querying.

You want to be notified automatically when a VM's average CPU usage exceeds 80 percent for five minutes. What should you configure in Azure Monitor?

• a.A resource lock on the VM
• b.A diagnostic setting only
• c.A metric alert rule with an action group✓
• d.A Log Analytics workspace with no rules

A metric alert rule in Azure Monitor evaluates a metric such as CPU percentage against a threshold and triggers when the condition is met, using an action group to send notifications or run actions. A diagnostic setting merely routes data to a destination and does not raise alerts on its own. Resource locks and empty workspaces do not generate notifications.

You need to back up an Azure VM on a daily schedule with retention policies and be able to restore it later. Which Azure service and resource should you use?

• a.Azure Backup with a Recovery Services vault✓
• b.Azure Monitor with a Log Analytics workspace
• c.A blob lifecycle management policy
• d.Network Watcher connection monitor

Azure Backup uses a Recovery Services vault to store backup data and lets you define a backup policy with schedule and retention for VMs, enabling later restore. A Log Analytics workspace stores monitoring logs, not VM backups. Lifecycle policies manage blob tiering, and Network Watcher diagnoses networking, so neither performs VM backup.