Microsoft Certification
59 practice questions with correct answers and detailed explanations. Use this guide to review concepts before taking the practice exam.
The Microsoft Microsoft Azure Administrator (AZ-104) certification validates professional expertise in Microsoft technologies. This study guide covers all 59 practice questions from our AZ-104 practice test, complete with correct answers and explanations to help you understand each concept thoroughly.
Review each question and explanation below, then test yourself with the full interactive practice exam to measure your readiness.
You need to configure a user account to require multi-factor authentication (MFA) for Azure portal access. Which Azure service should you use?
Azure AD Conditional Access policies allow you to enforce MFA based on specific conditions, such as sign-in risk or location. This is the primary method for enforcing MFA requirements.
Your organization needs to manage access to Azure resources using role-based access control (RBAC). What is the smallest scope at which you can assign an RBAC role?
RBAC roles can be assigned at multiple scopes: management group, subscription, resource group, or resource level. The resource level is the most granular scope available.
You have a virtual machine that needs to access Azure Key Vault without storing credentials in the application. Which approach should you implement?
Managed identities provide an Azure-managed identity that applications can use to authenticate to Azure services without storing credentials, improving security and manageability.
You need to monitor Azure virtual machines for performance issues. Which Azure service provides real-time metrics and alerting capabilities?
Azure Monitor collects, analyzes, and acts on telemetry data from Azure and on-premises environments, providing metrics, logs, and alerting capabilities for performance monitoring.
Your organization requires that all Azure resources be tagged with cost center information for billing purposes. How should you enforce this requirement?
Azure Policy allows you to enforce tagging requirements by creating policies that deny resource creation or modification if required tags are missing, ensuring compliance.
You have deployed a virtual machine in Azure and need to ensure it receives security updates automatically. Which feature should you enable?
Azure Update Management allows you to manage operating system updates for Windows and Linux virtual machines in Azure, including scheduling and deployment of patches.
You need to configure network security for a virtual network to restrict traffic. Which of the following is used to filter traffic at the network interface or subnet level?
Network Security Groups are stateful firewalls that filter traffic at the network interface or subnet level using inbound and outbound security rules based on source, destination, port, and protocol.
Your company needs to create multiple Azure resources with consistent configurations across different regions. What Azure tool should you use?
Azure Blueprints allow you to define and deploy sets of Azure resources with consistent configurations, governance policies, and RBAC assignments across multiple subscriptions and regions.
You are managing storage accounts in Azure and need to prevent accidental deletion of critical data. Which feature provides this protection?
Soft delete allows you to recover deleted blobs and file shares within a retention period, protecting against accidental or malicious deletion of data in Azure Storage.
Your organization uses Azure ExpressRoute for private connectivity to Azure. Which scenario is the primary use case for ExpressRoute?
Azure ExpressRoute provides private, dedicated network connections between on-premises data centers and Azure with low latency, high reliability, and consistent bandwidth.
You need to automate the scaling of a web application based on CPU utilization. Which Azure service should you configure?
Virtual Machine Scale Sets support autoscaling based on various metrics including CPU utilization, allowing automatic addition or removal of VM instances based on demand.
You are configuring backup for an Azure SQL Database. What is the primary recovery point objective (RPO) for automated backups?
Azure SQL Database performs automated backups with a recovery point objective of approximately 5 minutes due to transaction log backups, enabling recovery to any point within the retention period.
You need to implement a solution that allows users to access Azure resources from on-premises without exposing resources to the internet. Which networking solution is appropriate?
Site-to-Site VPN creates a secure, encrypted connection between on-premises networks and Azure virtual networks, allowing private access without exposing resources to the internet.
Your organization needs to monitor and audit changes to Azure resources. Which service provides compliance tracking and resource change history?
The Azure Activity Log records all control plane operations and changes to Azure resources, providing an audit trail for compliance and troubleshooting purposes.
You are implementing a disaster recovery solution for critical applications. Which Azure service provides native replication and failover capabilities for virtual machines?
Azure Site Recovery orchestrates replication and failover of virtual machines between Azure regions or on-premises to Azure, enabling comprehensive disaster recovery solutions.
You need to configure a custom domain name for an Azure App Service. Which Azure service should you use to manage DNS records?
Azure DNS provides DNS hosting for your domains with full support for DNS records, allowing you to configure custom domain names for Azure App Services and other resources.
Your organization requires encryption of data at rest in Azure Storage. What type of encryption is provided by default?
Azure Storage provides service-side encryption at rest using Microsoft-managed keys by default for all storage accounts, with optional customer-managed keys available.
You need to implement role-based access control for a team of developers. Which built-in Azure role provides read and write access to all Azure resources without managing permissions?
The Contributor built-in role grants full access to manage all Azure resources but does not allow managing permissions or assignments, whereas Owner can do both.
You are configuring network connectivity between two virtual networks in different Azure regions. Which approach provides low-latency, private connectivity?
Virtual network peering provides low-latency, private connectivity between virtual networks within Azure, supporting both same-region and cross-region scenarios without routing through gateways.
You need to ensure that Azure virtual machines maintain consistent performance. Which metric should you monitor in Azure Monitor?
Azure Monitor tracks multiple VM performance metrics including CPU, memory, disk I/O, and network activity. Comprehensive monitoring requires tracking all relevant metrics for optimal performance insight.
Your organization uses multiple Azure subscriptions for different departments. How should you enforce consistent security policies across all subscriptions?
Applying policies at the management group level ensures consistent enforcement across all child subscriptions and resource groups, providing centralized governance.
You need to store sensitive configuration data that applications can access securely. Which Azure service is designed specifically for this purpose?
Azure Key Vault is designed to securely store and manage secrets, encryption keys, and certificates, with built-in access control and audit logging for sensitive data.
You are implementing a highly available application tier in Azure. Which load balancing solution operates at Layer 7 (application layer)?
Azure Application Gateway is a Layer 7 load balancer providing application-level routing based on hostnames, URL paths, and other HTTP properties, while Load Balancer operates at Layer 4.
Your company needs to maintain compliance with data residency requirements. Which Azure feature allows you to control where data is stored?
By selecting specific Azure regions for resource deployment, you control data residency and can meet compliance requirements for data location and sovereignty.
You need to create a virtual network with a subnet that will contain 254 usable IP addresses. Which address space should you use?
A /24 subnet provides 256 total addresses, with 254 usable for hosts (minus network and broadcast). A /25 would only provide 128 total addresses with 126 usable, which is insufficient.
Your organization requires that all Azure resources be tagged with a cost center. You need to enforce this requirement across all resource groups. Which Azure feature should you use?
Azure Policy can enforce tagging requirements using the 'deny' or 'audit' effect to ensure compliance across subscriptions and resource groups. RBAC controls access, not resource properties.
You manage a virtual machine that experiences intermittent high CPU usage. You need to automatically scale the number of VMs based on CPU metrics. Which approach should you implement?
Virtual machine scale sets with autoscaling rules automatically add or remove VM instances based on performance metrics like CPU usage. Manual runbooks or VM resizing do not provide automatic scaling.
You need to grant a developer access to resources in a specific resource group. The developer should be able to create and modify resources but cannot delete resources or assign permissions. Which role should you assign?
The Contributor role allows users to create and modify resources but does not grant delete or permission assignment capabilities. Owner role would grant too much access, while Reader is read-only.
Your organization has multiple Azure subscriptions and needs centralized billing and policy management. Which service should you implement?
Azure Management Groups provide hierarchical organization of subscriptions for centralized policy application and billing aggregation across multiple subscriptions. Resource Groups organize resources within a subscription, not subscriptions themselves.
You have created a public IP address for a virtual machine but it is not currently in use. What will happen to your costs?
Azure charges for public IP addresses when they are allocated, regardless of whether they are associated with a running resource or actively used. To avoid charges, you must deallocate or delete the IP address.
You need to configure network security for a virtual machine to allow inbound HTTPS traffic from the internet while blocking all other inbound traffic. Which resource should you configure?
Network Security Groups (NSGs) are the primary resource for controlling inbound and outbound traffic to Azure resources at the network level. NSGs use rules to allow specific traffic like HTTPS (port 443).
You need to back up a virtual machine and retain the backup for 7 years due to compliance requirements. Which backup solution best meets this requirement?
Azure Backup supports long-term retention policies that can retain daily, weekly, monthly, and yearly backups for extended periods including 7+ years. Snapshots and Site Recovery are not designed for such long-term archival retention.
Your application requires a managed database solution that supports automatic backups, point-in-time restore, and scaling. Which Azure service should you choose?
Azure SQL Database is a managed service providing automatic backups, point-in-time restore, and elastic scaling without infrastructure management. SQL Server on VMs requires manual backup configuration.
You need to migrate an on-premises file server to Azure. The migration must minimize downtime and support ongoing synchronization of changes. Which tool should you use?
Azure File Sync enables hybrid cloud scenarios by synchronizing on-premises file servers with Azure file shares, supporting both initial migration and ongoing change replication. AzCopy is a one-time transfer tool without ongoing sync.
You are configuring authentication for an Azure App Service. You need to enable multi-factor authentication and support social identity providers. Which authentication method should you implement?
Azure AD B2C is designed for consumer-facing applications supporting multi-factor authentication, social identity providers, and custom user flows. B2B is for business-to-business collaboration with Azure AD users.
Your organization has a hybrid environment with on-premises Active Directory. You need to synchronize user identities to Azure AD with password hash synchronization. Which tool should you deploy?
Azure AD Connect synchronizes on-premises Active Directory to Azure AD and supports password hash synchronization. AD Connect Health monitors the sync health, while App Proxy enables remote access to on-premises apps.
You have a storage account that contains sensitive data. You need to ensure that data is encrypted both in transit and at rest. Which encryption technologies should you verify are enabled?
Storage Service Encryption encrypts data at rest, while HTTPS/TLS encrypts data in transit. Together they provide comprehensive encryption. TDE applies to SQL databases, and Disk Encryption applies to VM disks.
You need to assign permissions to a group of developers to manage resources in a production resource group, but you want to prevent accidental deletions. Which approach is most appropriate?
Combining the Contributor role with a CanNotDelete lock prevents developers from accidentally deleting resources while still allowing resource creation and modification. Owner role grants too much access.
Your application stores session data in a Redis cache. You need to ensure the cache is highly available and can be scaled horizontally. Which Azure Cache for Redis tier should you use?
The Premium tier of Azure Cache for Redis supports clustering for horizontal scaling and high availability features including replication and failover. Standard and Basic tiers do not support clustering.
You need to monitor Azure resources and receive alerts when CPU usage exceeds 80%. Which service should you configure?
Azure Monitor metric alerts can trigger notifications based on performance thresholds like CPU usage. Advisor provides recommendations, Service Health shows service status, and Application Insights focuses on application performance.
Your organization needs to implement disaster recovery for a web application with an RTO of 1 hour and RPO of 15 minutes. Which Azure service should you use?
Azure Site Recovery provides automated replication and failover with configurable RTO/RPO objectives, supporting continuous replication to meet the 15-minute RPO requirement. Backup and manual failover do not provide the required automation.
You are configuring a storage account for a web application. You need to enable CORS for requests from a specific domain. Where should you configure CORS settings?
CORS settings for Azure Storage are configured directly in the storage account's CORS configuration to allow cross-origin requests from specified domains. Application-level configuration does not control storage CORS.
You have deployed an application to multiple regions and need to distribute traffic based on geographic location. Which Azure service should you use?
Azure Front Door provides global load balancing and geographic routing at the edge network level. Traffic Manager routes at the DNS level, while Load Balancer and Application Gateway operate regionally.
You need to automate the deployment of Azure resources using a declarative template. Which tool should you use?
Azure Resource Manager (ARM) templates provide declarative infrastructure-as-code for repeatable, consistent deployments. CLI and PowerShell scripts are imperative and require sequential execution.
Your organization requires that virtual machines use managed disks for all new deployments. You need to enforce this requirement across all subscriptions. Which solution should you implement?
Azure Policy with a deny effect prevents the creation of resources that violate the policy, enforcing mandatory use of managed disks. Manual procedures and Blueprints are not enforceable, and RBAC does not control resource properties.
You need to access an on-premises database from an Azure application without exposing the database to the internet. Which technology should you implement?
ExpressRoute or Site-to-Site VPN creates secure private connectivity between Azure and on-premises networks without internet exposure. Public IPs and internet routing would expose the database.
You are managing multiple virtual machines and need to apply configuration management at scale. Which Azure service provides this capability?
Azure Automation with Desired State Configuration enables automated configuration management across multiple VMs at scale. Manual connections do not scale, and Backup/Monitor have different purposes.
You need to ensure that a virtual machine can access an Azure Key Vault to retrieve encryption keys without storing credentials. Which feature should you use?
Managed Identity allows VMs to authenticate to Azure services without storing credentials, automatically managing token refresh. Service Principals require credential storage, SAS tokens are for storage access, and user accounts require password management.
Your organization has strict data residency requirements requiring data to remain in a specific geographic region. Which Azure feature helps enforce this requirement?
Azure Policy can enforce location restrictions using conditions that deny resource creation outside specified regions. Manual selection is not enforceable, resource groups do not enforce location compliance, and NSGs do not control deployment regions.
You need to configure Azure virtual machines to automatically scale based on CPU utilization. Which Azure service should you use?
Virtual Machine Scale Sets combined with autoscale rules allow automatic scaling of VMs based on metrics like CPU utilization. The other services handle load balancing or routing but don't provide autoscaling functionality.
Your organization requires that all Azure resources be tagged with a cost center code. What is the most efficient way to enforce this requirement?
Azure Policy provides governance at scale by enforcing tagging requirements and preventing non-compliant resources from being created. Manual tagging and scripts are not scalable solutions.
You are managing storage accounts and need to ensure that data is automatically tiered between hot, cool, and archive access tiers based on age. Which feature should you implement?
Blob lifecycle management policies automatically move blobs between access tiers based on age and other criteria. This optimizes costs by moving infrequently accessed data to cooler tiers.
You need to monitor Azure resources and create alerts when specific conditions occur. A colleague suggests using Azure Monitor. Which of the following is NOT a capability of Azure Monitor?
Azure Monitor handles alerting, logging, and performance tracking, but automatic VM patching is handled by Update Management or Azure Automation. Azure Monitor does not directly manage patch schedules.
Your organization has multiple Azure subscriptions across different departments. You need to implement a centralized billing and governance structure. What should you use?
Management groups enable hierarchical organization of multiple subscriptions, allowing centralized policy application and billing oversight across departments. A flat subscription structure lacks governance capabilities.
You have configured a Network Security Group (NSG) with inbound rules that allow SSH on port 22 from a specific IP address. After deployment, SSH connections are still blocked. What is the most likely cause?
NSG rules only take effect when the NSG is associated with a subnet or network interface. If the NSG exists but isn't attached to the correct resource, it won't be applied.
You are designing a disaster recovery solution for a critical application. The business requirement is that data loss should not exceed 1 hour and downtime should not exceed 4 hours. Which metrics are you defining?
RTO (Recovery Time Objective) is maximum allowable downtime, and RPO (Recovery Point Objective) is maximum acceptable data loss. The question specifies 4 hours downtime tolerance and 1 hour data loss tolerance.
You need to provide developers with temporary access to Azure resources for testing. Which approach provides the most secure method with automatic expiration?
Azure AD PIM provides just-in-time access with automatic expiration, time limits, and approval workflows. This is more secure than permanent accounts or overly permissive Owner role assignments.
You are configuring backup for Azure virtual machines. Which backup solution provides the ability to backup VMs across regions and retain backups for up to 10 years?
Azure Backup combined with GRS provides cross-region protection and supports retention policies up to 10 years for long-term archival needs. Site Recovery is for disaster recovery, not long-term backup retention.
Your organization uses Azure virtual networks with on-premises infrastructure. You need to establish a secure, encrypted connection with predictable latency. Which solution is most appropriate?
ExpressRoute provides dedicated, private connectivity with consistent performance and encryption capabilities, superior to internet-based VPN for latency-sensitive workloads. It does not traverse the public internet.
You've reviewed all 59 questions. Take the interactive practice exam to simulate the real test environment.
▶ Start Practice Exam — Free