AZ-104 — Azure Administrator Associate

Full question text, answer options, and explanations for this practice set — a spoiler-free alternative is the interactive quiz above for scored, shuffled practice.

1. 1. An Azure administrator needs to allow users to reset their own passwords without contacting the help desk. Which feature should be enabled in Microsoft Entra ID?

   • A. Conditional Access policy
   • B. Self-service password reset (SSPR)(correct)
   • C. Privileged Identity Management (PIM)
   • D. Microsoft Entra ID Protection

   Explanation: Self-service password reset (SSPR) is the Microsoft Entra ID feature that allows users to reset their own passwords through a web portal or mobile app without requiring administrator or help desk intervention. Conditional Access policies (A) control which users can access which resources based on conditions but do not provide password reset. PIM (C) manages privileged role assignments. Entra ID Protection (D) detects risk events and enforces policies — it does not directly enable user-initiated password resets.

2. 2. A company has a subscription with several resource groups. A developer accidentally deleted a critical resource group containing production virtual machines. Which feature, if configured beforehand, would have prevented this deletion?

   • A. Azure Policy with a deny effect
   • B. Resource tags
   • C. Resource locks (CanNotDelete lock)(correct)
   • D. Management group hierarchy

   Explanation: A CanNotDelete resource lock prevents any user, including owners, from deleting a resource or resource group until the lock is explicitly removed. Azure Policy with a deny effect (A) can restrict the creation or modification of resources but does not prevent deletion by default. Resource tags (B) are metadata labels that aid management and cost tracking but have no access-control enforcement. Management groups (D) organize subscriptions for governance but do not directly block deletion.

3. 3. Contoso has three subscriptions: Dev, Test, and Production. The security team requires that all virtual machines across all three subscriptions must have the 'CostCenter' tag applied. If a VM is created without this tag, the deployment should be rejected. What is the most efficient solution?

   • A. Create a separate Azure Policy with a deny effect in each subscription
   • B. Assign an Azure Policy with a deny effect at the management group level that contains all three subscriptions(correct)
   • C. Create an ARM template that enforces the tag and share it with all teams
   • D. Configure role-based access control (RBAC) to prevent deployments without tags

   Explanation: Assigning an Azure Policy with a deny effect at the management group level automatically applies the policy to all subscriptions within that management group, including Dev, Test, and Production — this is the most efficient single-point-of-management approach. Creating separate policies per subscription (A) achieves the goal but requires three separate assignments and ongoing maintenance. An ARM template (C) can enforce tags in deployments but cannot prevent other deployment methods. RBAC (D) controls who can perform actions but cannot enforce resource property requirements like tag presence.

4. 4. An administrator wants to grant a group of junior admins the ability to start and stop virtual machines in a specific resource group, but not create or delete them. Which is the correct approach?

   • A. Assign the Contributor role at the subscription scope
   • B. Assign the Virtual Machine Contributor built-in role at the resource group scope(correct)
   • C. Assign the Owner role at the resource group scope and use a deny assignment to block delete
   • D. Assign the Reader role at the subscription scope and a custom role at the VM level

   Explanation: The Virtual Machine Contributor built-in role grants permission to manage virtual machines (including start/stop/restart) but does not grant rights to the underlying virtual network or storage, and does not include the ability to delete the resource group itself. Assigning Contributor at the subscription scope (A) grants too much permission across all resources in the subscription. Assigning Owner with a deny assignment (C) is unnecessarily complex and deny assignments are managed differently. Reader at subscription scope (D) is read-only and would not allow starting or stopping VMs.

5. 5. An organization wants to control Azure spending and receive notifications before costs exceed budgeted amounts. Which two features should the administrator configure? Choose 2.

   • A. Azure Advisor cost recommendations
   • B. A budget with alert thresholds in Microsoft Cost Management(correct)
   • C. Resource locks on all resource groups
   • D. An action group email notification triggered by a budget alert(correct)
   • E. A custom RBAC role that denies resource creation above a cost limit

   Explanation: A budget with alert thresholds in Microsoft Cost Management (B) is the core mechanism to define spending limits and trigger alerts at defined percentages. An action group with email notification (D) is the delivery mechanism that sends the alert to the right people when the budget threshold is crossed. Azure Advisor (A) provides recommendations but does not send proactive budget alerts. Resource locks (C) prevent deletion but have no cost-control function. A custom RBAC role (E) cannot enforce monetary cost limits — Azure RBAC operates on actions, not costs.

6. 6. A company's Azure administrator reviews an access assignment and sees that a user has the Owner role at the subscription scope and the Reader role at a specific resource group scope. What effective permissions does the user have on resources inside that resource group?

   • A. Reader only — the more restrictive role at the narrower scope wins
   • B. Owner — the broader scope role is additive and supersedes the Reader assignment(correct)
   • C. No access — conflicting role assignments result in an access denied state
   • D. Reader for read operations and Owner for write operations simultaneously

   Explanation: Azure RBAC is additive: a user's effective permissions are the union of all role assignments across all applicable scopes. The Owner role assigned at the subscription scope already grants full Owner permissions on everything in the subscription, including all resource groups within it. The additional Reader role assignment at the resource group scope adds no new permissions — the user retains Owner-level access on that resource group. Azure RBAC does not apply a 'most restrictive wins' model unless a deny assignment is used.

7. 7. An application needs temporary, delegated read-only access to a specific Azure Blob Storage container for external partners without sharing the storage account access keys. Which approach should the administrator use?

   • A. Share the storage account primary access key with partners
   • B. Create a Shared Access Signature (SAS) token scoped to the container with read permissions and an expiry time(correct)
   • C. Configure anonymous public access on the container
   • D. Create a new storage account with the same data for partners

   Explanation: A Shared Access Signature (SAS) token provides granular, time-limited delegated access to specific storage resources without exposing the account key. It can be scoped to a container, restricted to read operations, and given an expiry time — matching all the requirements. Sharing the primary access key (A) grants full account-level access, which violates least-privilege. Anonymous public access (C) is indiscriminate and cannot be revoked per partner. Creating a duplicate storage account (D) wastes cost and creates data-sync challenges.

8. 8. Fabrikam stores compliance documents in Azure Blob Storage. Documents must be retained for 7 years and cannot be modified or deleted during the retention period. After 7 years, documents older than 7 years should be automatically moved to Archive tier and eventually deleted after 10 years. Which combination of features should be configured?

   • A. Immutability policy for 7-year retention, and blob lifecycle management rules for tiering and deletion(correct)
   • B. A CanNotDelete resource lock on the storage account, and manual archiving after 7 years
   • C. Blob versioning and soft delete to prevent accidental deletion
   • D. Azure Backup with 7-year retention and manual deletion after 10 years

   Explanation: An immutability policy (WORM — Write Once, Read Many) prevents modification or deletion for the specified retention period, satisfying compliance requirements. Blob lifecycle management rules automate tier transitions (to Archive after 7 years) and deletion (after 10 years) without manual intervention. A resource lock (B) prevents deletion of the account but not individual blobs, and requires manual lifecycle steps. Blob versioning and soft delete (C) are recovery features, not compliance enforcement. Azure Backup (D) creates copies but does not prevent modification of the originals.

9. 9. An organization requires that Azure Storage accounts only accept connections from specific on-premises IP ranges and from a designated Azure virtual network subnet. Which feature should the administrator configure?

   • A. Azure Storage firewalls and virtual networks(correct)
   • B. Shared access signatures with IP restrictions
   • C. Identity-based access for Azure Files
   • D. Stored access policies

   Explanation: Azure Storage firewalls and virtual networks allow administrators to configure network-level access rules, whitelisting specific public IP ranges and specific virtual network subnets, while blocking all other traffic. SAS tokens with IP restrictions (B) restrict individual tokens but do not protect the entire storage account at the network level. Identity-based access for Azure Files (C) relates to authentication protocol, not network perimeter control. Stored access policies (D) are associated with SAS tokens for lifecycle management, not network firewall rules.

10. 10. A storage administrator configures an Azure Storage account with Zone-Redundant Storage (ZRS). The primary region suffers a complete zone failure. What is the expected behavior for read and write operations?

    • A. Both reads and writes fail until Microsoft manually fails over to the secondary region
    • B. Data remains available for reads and writes because ZRS synchronously replicates across three availability zones in the same region(correct)
    • C. Reads are served from the secondary region but writes are blocked until the zone recovers
    • D. Azure automatically promotes the secondary LRS copy, making the account available within minutes

    Explanation: ZRS synchronously replicates data across three separate availability zones within a single Azure region. A single zone failure does not cause data unavailability because the remaining two zones still hold complete copies and can serve both reads and writes without any failover. Option A is incorrect because no regional failover is needed for a single-zone failure with ZRS. Option C describes GRS secondary-read behavior, which is not applicable to ZRS. Option D describes LRS, which has no zone resilience and does not automatically fail over.

11. 11. An administrator needs to deploy an Azure virtual machine and ensure it is protected against the failure of an entire Azure datacenter. Which option should be chosen during VM creation?

    • A. Availability set
    • B. Availability zone(correct)
    • C. Proximity placement group
    • D. Reserved instance

    Explanation: Availability zones are physically separate locations within an Azure region, each with independent power, cooling, and networking. Deploying a VM to an availability zone protects against a full datacenter failure. Availability sets (A) distribute VMs across fault domains and update domains within a single datacenter — they protect against hardware failures and planned maintenance but not datacenter-level outages. Proximity placement groups (C) keep VMs close together to minimize network latency but provide no fault tolerance. Reserved instances (D) are a billing commitment, not a placement or redundancy option.

12. 12. A developer provides a Bicep file to deploy an Azure resource group and its resources. The administrator has never used Bicep before and wants to understand the structure without deploying it. Which is the most appropriate next step?

    • A. Convert the Bicep file to an ARM template and deploy the ARM template
    • B. Interpret the Bicep file by reviewing its resource declarations, parameter definitions, and output blocks to understand the intent before deployment(correct)
    • C. Delete the Bicep file and recreate the resources manually in the Azure portal
    • D. Run az deployment group create without a --parameters file to test the structure

    Explanation: Interpreting the Bicep file — reviewing resource declarations, parameters, variables, and outputs — is the correct approach to understand what a Bicep file deploys before executing it. This is a key exam skill: reading and understanding existing IaC files. Converting to ARM (A) is a valid secondary step for troubleshooting but not necessary to understand the structure. Recreating manually (C) defeats the purpose of IaC. Running a deployment without parameters (D) may fail or deploy resources with defaults unintentionally.

13. 13. A web application runs on a single Azure App Service instance and experiences intermittent slowdowns during business hours due to high traffic. The operations team wants to automatically add more compute capacity when CPU exceeds 75% and scale in when it drops below 30%. What should the administrator configure?

    • A. Manually increase the App Service plan tier to Premium every morning
    • B. Configure scaling for the App Service plan with a scale-out rule triggered at 75% CPU and a scale-in rule at 30% CPU(correct)
    • C. Deploy the app to Azure Container Instances for automatic scaling
    • D. Enable deployment slots to switch between two environments during peak hours

    Explanation: Configuring autoscale rules on the App Service plan with CPU-based scale-out and scale-in thresholds is the correct solution for automatic horizontal scaling in response to load. This is configured directly on the App Service plan (not the App Service itself). Manual tier increases (A) require human intervention and do not respond dynamically to load. Azure Container Instances (C) are not a replacement for App Service hosting and do not provide managed autoscale for web apps. Deployment slots (D) are for staged deployments and A/B testing, not for handling traffic spikes.

14. 14. An administrator deploys a stateless containerized microservice to Azure Container Apps. The app currently runs 3 replicas. During off-peak hours, no requests are coming in. The team wants to reduce cost by scaling to zero replicas when there is no traffic. Which feature of Azure Container Apps enables this?

    • A. Azure Container Apps supports scale-to-zero via KEDA-based HTTP scaling rules(correct)
    • B. Configuring a minimum replica count of 0 on Azure Container Instances
    • C. Using Azure Virtual Machine Scale Sets with a scheduled scale-in policy
    • D. Enabling the Always On setting on the App Service plan

    Explanation: Azure Container Apps uses KEDA (Kubernetes-based Event Driven Autoscaler) for scaling, which natively supports scaling to zero replicas when an HTTP scaler detects no incoming traffic. Setting the minimum replica count to 0 in Container Apps (not Container Instances) enables this zero-cost idle state. Option B references Azure Container Instances which are not the same as Container Apps and do not have built-in auto-scaling. VM Scale Sets (C) can scale to zero but are not the right service for this containerized app scenario. 'Always On' in App Service (D) is the opposite — it keeps the app running at all times.

15. 15. An administrator needs to move a production virtual machine from subscription A to subscription B. Which two prerequisites must be true for the move to succeed? Choose 2.

    • A. The VM must be deallocated before initiating the move
    • B. Both subscriptions must be associated with the same Microsoft Entra tenant(correct)
    • C. The destination subscription must have the same geographic region as the source
    • D. The source and destination resource groups must be in the same Azure region
    • E. The administrator must have Microsoft.Resources/subscriptions/resourceGroups/moveResources/action permission in both subscriptions(correct)

    Explanation: For a cross-subscription move, both subscriptions must be associated with the same Microsoft Entra (Azure AD) tenant (B) — moves across different tenants are not supported. The administrator also needs the moveResources action permission in both the source and destination (E). The VM does not need to be deallocated (A) for all resource moves, though some resource types have specific requirements. Subscriptions do not need to be in the same region (C) — subscriptions span all regions. Resource groups in different regions can still participate in a move (D).

16. 16. An administrator needs to push a custom container image to Azure Container Registry (ACR) and deploy it to Azure Container Instances. Which sequence of steps is correct?

    • A. Create ACR → Build/tag image locally → docker push to ACR → Create Container Instance referencing the ACR image(correct)
    • B. Create Container Instance → pull image from Docker Hub → create ACR → replicate image
    • C. Build image → push to Docker Hub → Create ACR → Import image → Create Container Instance
    • D. Create ACR → Create Container Instance → push image from Container Instance to ACR

    Explanation: The correct workflow is: create the Azure Container Registry, build and tag the Docker image with the ACR login server URI, authenticate with 'az acr login' or docker login, push the image to ACR, then create the Azure Container Instance referencing the private ACR image with appropriate registry credentials. Option B reverses the logical order and Docker Hub is not required. Option C adds an unnecessary Docker Hub step. Option D is impossible — Container Instances run containers; they do not push images to registries.

17. 17. Two virtual networks in the same Azure region need to communicate with each other using private IP addresses without traffic traversing the public internet. Which feature should be configured?

    • A. Azure VPN Gateway
    • B. Virtual network peering(correct)
    • C. Azure ExpressRoute
    • D. Network security group (NSG)

    Explanation: Virtual network peering connects two Azure virtual networks, enabling resources in each VNet to communicate using private IP addresses over the Azure backbone — no public internet traversal and no gateway required. VPN Gateway (A) is used for encrypted site-to-site connections across the public internet or between VNets when transit routing is needed, but it adds cost and complexity unnecessary for same-region VNet-to-VNet communication. ExpressRoute (C) is a private circuit connecting on-premises to Azure, not for VNet-to-VNet. NSGs (D) are traffic filters, not connectivity mechanisms.

18. 18. A network administrator needs to allow only HTTPS traffic (port 443) to a subnet hosting web servers, while blocking all other inbound traffic. All other subnets in the VNet should remain unaffected. What is the correct approach?

    • A. Create a network security group with an allow rule for port 443 and a deny-all rule, then associate the NSG with the web server subnet(correct)
    • B. Create a network security group with an allow rule for port 443 and associate it with the entire virtual network
    • C. Configure a user-defined route to redirect port 443 traffic to the web servers
    • D. Create an application security group and apply it to all VMs in all subnets

    Explanation: An NSG with an explicit allow rule for port 443 inbound and a deny-all rule (lower priority number means higher evaluation priority for allow; the default DenyAllInBound rule at priority 65500 already blocks all traffic not explicitly allowed) applied at the subnet level affects only that subnet. The default deny-all inbound rule in an NSG already blocks all other traffic unless explicitly allowed, so the administrator only needs to add the allow rule for 443 and associate the NSG with the correct subnet. Associating the NSG with the entire VNet (B) is not possible — NSGs associate with subnets or NICs, not VNets. User-defined routes (C) control routing, not traffic filtering. Application security groups (D) are used for grouping VMs in NSG rules, not for subnet-level isolation.

19. 19. An administrator receives a ticket stating that VM-A in subnet-1 cannot reach VM-B in subnet-2, both within the same VNet. Other VMs in subnet-1 can reach subnet-2 without issues. What is the first diagnostic step to take?

    • A. Restart both VMs to refresh their network configuration
    • B. Use Azure Network Watcher Connection Monitor to test connectivity between VM-A and VM-B and identify the blocking component(correct)
    • C. Delete and recreate the VNet peering between subnet-1 and subnet-2
    • D. Redeploy VM-A to a different subnet

    Explanation: Azure Network Watcher and Connection Monitor are the recommended first diagnostic tools for network connectivity issues. Connection Monitor can identify whether the failure is due to an NSG rule, a UDR, a VM-level firewall, or an application issue — pinpointing the root cause without disruptive actions. Restarting VMs (A) is disruptive and unlikely to resolve a network routing or security rule issue. Deleting and recreating peering (C) would affect all traffic between the subnets and is inappropriate when other VMs communicate normally. Redeploying VM-A (D) is destructive and not a diagnostic step.

20. 20. An organization needs to provide secure administrative access (RDP/SSH) to Azure VMs without exposing them to the public internet or requiring a VPN client. The VMs have no public IP addresses assigned. Which service should the administrator deploy?

    • A. Azure VPN Gateway with point-to-site connectivity
    • B. Azure Bastion(correct)
    • C. Just-in-time (JIT) VM access via Microsoft Defender for Cloud
    • D. Public IP addresses assigned to each VM's NIC

    Explanation: Azure Bastion is a fully managed PaaS service that provides secure RDP and SSH access to Azure VMs directly from the Azure portal over SSL, without requiring a public IP on the VM or a VPN client. It is deployed into a dedicated subnet (AzureBastionSubnet) in the VNet. VPN Gateway with point-to-site (A) does provide secure connectivity but requires a VPN client to be installed and configured on each administrator's device. JIT VM access (C) reduces the exposure window for public IP-attached VMs but still requires the VM to have a public IP. Assigning public IPs (D) directly contradicts the requirement to avoid public internet exposure.

21. 21. An administrator needs to allow VMs in a VNet to securely access Azure SQL Database using private IP addresses, without routing traffic through the public internet. The SQL Database should not be accessible from the internet at all. Which feature should be configured?

    • A. Configure a service endpoint for Azure SQL Database on the subnet
    • B. Configure a private endpoint for Azure SQL Database(correct)
    • C. Configure Azure DNS to resolve the SQL server FQDN to a private IP
    • D. Enable VNet integration on the Azure SQL Database firewall

    Explanation: A private endpoint assigns a private IP address from the VNet to the Azure SQL Database, and the service becomes entirely inaccessible from the public internet when configured with public access disabled. Traffic flows entirely within the Azure private network. Service endpoints (A) improve routing to the service but the service still has a public endpoint; public access is not completely removed by service endpoints alone. Azure DNS private zones (C) are often used alongside private endpoints but alone do not control network routing. VNet integration (D) is an App Service feature, not applicable to SQL Database.

22. 22. An Azure administrator wants to query diagnostic logs from multiple Azure services over the past 30 days to identify patterns in failed authentication attempts. Which tool should be used?

    • A. Azure Metrics in Azure Monitor
    • B. Azure Monitor Log Analytics with a KQL query(correct)
    • C. Azure Service Health
    • D. Azure Advisor

    Explanation: Azure Monitor Log Analytics stores diagnostic log data and allows querying using Kusto Query Language (KQL), which can correlate data from multiple sources over custom time ranges. Azure Metrics (A) stores numerical telemetry data (CPU, memory, etc.) and is not designed for log-level event querying. Azure Service Health (C) reports on Azure platform incidents affecting your subscription, not application-level logs. Azure Advisor (D) provides best-practice recommendations but does not enable ad-hoc log queries.

23. 23. A production Azure VM is accidentally deleted. The organization had Azure Backup configured for the VM with daily snapshots and a 30-day retention policy. How should the administrator restore the VM?

    • A. Re-create the VM manually from the Azure Marketplace and restore data from a storage account backup
    • B. Use Azure Site Recovery to fail over to the secondary region
    • C. Perform a backup and restore operation using Azure Backup to restore the VM from a recovery point within the Recovery Services vault(correct)
    • D. Contact Microsoft support to recover the deleted VM from their internal snapshots

    Explanation: Azure Backup stores recovery points in a Recovery Services vault. When a VM is deleted, the administrator can navigate to the vault, select the backup item for the deleted VM, choose a recovery point from within the retention window, and perform a restore operation — either to the original location or a new VM. Azure Site Recovery (B) is for disaster recovery (regional failover), not for recovering accidentally deleted VMs. Recreating manually (A) would not restore application data or configuration. Contacting Microsoft support (D) is not the recovery path — Azure Backup is the proper mechanism.

24. 24. An administrator wants to be alerted when a virtual machine's CPU utilization exceeds 90% for more than 5 minutes. Which two components must be configured in Azure Monitor to achieve this? Choose 2.

    • A. An alert rule with a metric condition targeting the VM's Percentage CPU metric with an aggregation of Average over 5 minutes(correct)
    • B. An action group that defines the notification recipients and action type (e.g., email)(correct)
    • C. A Log Analytics workspace linked to the VM
    • D. An Azure Policy assignment to monitor CPU thresholds
    • E. A diagnostic setting to export VM metrics to a storage account

    Explanation: An alert rule (A) defines the condition — in this case, a metric alert on Percentage CPU with an Average aggregation over a 5-minute evaluation window crossing 90% — and fires when the condition is met. An action group (B) defines what happens when the alert fires (send email, call webhook, trigger Logic App, etc.). Without both, the monitoring condition either has no notification or there is no defined condition to trigger on. A Log Analytics workspace (C) is needed for log-based alerts, not metric-based ones like CPU percentage. Azure Policy (D) governs resource configuration compliance, not real-time metric alerting. A diagnostic setting to storage (E) archives data but does not create alerts.

25. 25. A company's production workload runs in the East US region. To meet an RTO of 1 hour and RPO of 15 minutes in case of a regional disaster, which Azure service and configuration should the administrator implement?

    • A. Azure Backup with hourly snapshots to a Recovery Services vault in the same region
    • B. Azure Site Recovery replicating VMs to a secondary region with a recovery plan, and perform a failover to a secondary region by using Site Recovery(correct)
    • C. Geo-redundant storage (GRS) for VM disks with manual failover to the secondary region
    • D. Azure Advisor recommendations to optimize VM performance and avoid downtime

    Explanation: Azure Site Recovery provides continuous replication of Azure VMs to a secondary region with RPO as low as a few minutes (well within the 15-minute requirement) and automated recovery plans that can bring VMs online in the secondary region within the 1-hour RTO. Azure Backup (A) protects against data loss but restoring from backup typically takes longer than 1 hour and backups in the same region do not protect against regional outages. GRS (C) replicates storage data to a secondary region but does not replicate VM configuration or provide automated compute failover. Azure Advisor (D) provides recommendations, not disaster recovery capabilities.