AZ 104
  • AZ-104 Assessment
  • Azure Administrator Assessment
  • AZ-104 Exam Renewal Test

Question 1 

You have an Azure web service named Contoso2022 that runs in the Standard App Service plan. Contoso2022 has five deployment slots in use.

A user named User1 has the Contributor role for Contoso2022.

You need to ensure that User1 can create additional deployment slots to Contoso2022.

What should you do?

  • Assign User1 the Owner role for Contoso2022.
  • Assign User1 the Website Contributor role for Contoso2022.
  • Scale out the Contoso2022 App Service plan.
  • Scale up the Contoso2022 App Service plan.

Correct Answer: Assign User1 the Owner role for Contoso2022.
Explanation:
The Contributor role allows modifying resources but doesn’t grant permissions to create additional deployment slots. The Owner role provides full access to manage all resources, including creating deployment slots. The Website Contributor role doesn’t add permissions for managing deployment slots. Scaling out or up the App Service plan is irrelevant in this scenario.

Question 2

You plan to deploy the following Azure web apps:

  • WebApp1, that runs on Windows Server 2016
  • WebApp2, that runs on Windows Server 2022
  • WebApp3, that runs on Ubuntu Server
  • WebApp4, that runs on Red Hat Enterprise Linux

You need to create the app service plans for the web apps.

What is the minimum number of app service plans that should be created?

  • 1
  • 2
  • 3
  • 4

Correct Answer: 2
Explanation:
Azure App Service plans are grouped based on operating system types:

Windows-based plans: WebApp1 and WebApp2 can share a single App Service Plan because both run on Windows (even though they use different versions of Windows Server).

Linux-based plans: WebApp3 and WebApp4 can share another App Service Plan because both run on Linux-based operating systems (Ubuntu and Red Hat Enterprise Linux).

Hence, the minimum number of App Service Plans required is 2: one for Windows-based apps and one for Linux-based apps.

Question 3

You plan to deploy an Azure web app that will have the following settings:

  • Name: WebApp1
  • Publish: Docker Container
  • Operating system: Windows
  • Region: West US
  • Windows Plan (West US): ASP-RG1-8bcf

You need to ensure that WebApp1 uses the ASP.NET V4.8 runtime stack.

Which setting should you modify?

  • Operating system
  • Publish 
  • Region
  • Windows Plan

Correct Answer: Publish
Explanation:
The ASP.NET V4.8 runtime stack is only supported for code-based web apps on Azure App Service and not for Docker containers. Docker containers are designed for custom runtime stacks, and you need to switch the Publish setting from “Docker Container” to “Code” to use the ASP.NET V4.8 runtime stack.

This allows the web app to use the built-in ASP.NET V4.8 runtime provided by Azure App Service. Other settings like Operating System, Region, and Windows Plan do not directly affect the runtime stack compatibility.

Question 4

You have an Azure app service web app named WebApp1 that runs in the Standard App Service plan.

You plan to add deployment slots for WebApp1.

What is the maximum number of deployment slots that you can add to WebApp1?

  • 1
  • 4
  • 6
  • 9

Correct Answer: 4
Explanation:
In Azure App Service, the Standard App Service Plan allows up to 5 deployment slots, including the production slot. This means you can add 4 additional deployment slots to your app. Deployment slots are used for testing in different environments (e.g., staging, testing) and swapping seamlessly without downtime.

Higher-tier plans like Premium allow more deployment slots, but for Standard, the limit is 4 additional slots beyond the production environment.

Question 5 

You have an Azure subscription that includes a virtual network with the following subnets:

  • Subnet1, which has connected virtual machine
  • Subnet2, which has connected web app
  • Subnet3, which has deployed container instance

You plan to deploy a container instance named container1.

To which subnets can you deploy container1?

  • Subnet1 and Subnet3 only
  • Subnet1, Subnet2, and Subnet3
  • Subnet2 and Subnet3 only
  • Subnet3 only 

Correct Answer: Subnet3 only
Explanation:
Azure Container Instances (ACI) can only be deployed to subnets that are explicitly configured to support container instances. Subnet3 is specified in the question as having deployed container instances, indicating that it is the only subnet configured to host containers.

Other subnets like Subnet1 and Subnet2 are connected to virtual machines and web apps, respectively, which are not compatible with deploying Azure Container Instances. Hence, the correct choice is Subnet3 only.

Question 6 

You have an Azure container registry that stores an image named Image1 and a Windows Server 2022 Azure virtual machine named VM1.

You need to ensure that you can run Image1 in VM1.

What should you install in VM1?

To which subnets can you deploy container1?

  • Azure Portal
  • Docker
  • Hyper-V role
  • .NET Framework 4.7 

Correct Answer: Docker
Explanation:
To run a container image like Image1 from an Azure Container Registry (ACR) on a Windows Server 2022 virtual machine (VM1), you need a container runtime environment. Docker is the most commonly used container runtime for running images in such scenarios.

Question 7 

You have an Azure subscription that contains the following resources:

  • A storage account named storage123
  • A container instance named AppContainer

The subscription contains a virtual network named VirtualNet4 that has the following subnets:

  • SubnetA – has a Microsoft.Storage service endpoint.
  • SubnetB – AppContainer is deployed to SubnetB.
  • SubnetC – No resources are connected to SubnetC.

You plan to deploy an Azure container instance named container5 to VirtualNet4.

To which subnets can you deploy container5?

  • SubnetA, SubnetB, and SubnetC
  • SubnetB and SubnetC only
  • SubnetB only
  • SubnetC only

Correct Answer: SubnetB and SubnetC only
Explanation:
SubnetA: The Microsoft.Storage service endpoint is configured here. Subnets with a service endpoint are generally used for resources that interact specifically with that service. Since a storage service endpoint is configured, this subnet is not suitable for container deployment.
SubnetB: The AppContainer is already deployed here, and subnets can typically host multiple container instances, provided there are no constraints or policies preventing it. Therefore, container5 can be deployed to SubnetB.
SubnetC: No resources are currently connected to SubnetC, making it available for deployment. This means container5 can also be deployed here.

Thus, container5 can be deployed to SubnetB and SubnetC only.

Question 8 

You have an Azure storage account that contains a blob container named container1.

You need to configure access to container1.

Which authorization types can you use?

  • Microsoft Entra ID only
  • Microsoft Entra ID, shared access signature or certificate only
  • Microsoft Entra ID, storage key or shared access signature only
  • Microsoft Entra ID, storage key, shared access signature or certificate
  • Storage key or shared access signature only

Correct Answer: Microsoft Entra ID, storage key, or shared access signature only

Explanation: To configure access to an Azure blob container (container1), the following methods are valid:

  1. Microsoft Entra ID (formerly Azure AD): Provides role-based access control (RBAC) to access Azure resources securely.
  2. Storage account key: A primary/secondary key that grants full access to the storage account.
  3. Shared Access Signature (SAS): Provides granular and time-limited access to the container or specific resources within it.

Certificates are not typically used as a direct access mechanism for blob containers, and the other options that mention certificates are therefore incorrect. Hence, the correct choice is “Microsoft Entra ID, storage key, or shared access signature only.”

Question 9 

You have an Azure subscription that contains the following storage accounts:

  • storage1, configured as StorageV2 kind
  • storage2, configured as BlobStorage kind
  • storage3, configured as FileStorage kind

Which storage account or storage accounts can you use Lifecycle management?

  • storage1 and storage2 only
  • storage1 and storage3 only
  • storage1 only
  • storage1, storage2, and storage3
  • storage2 and storage3 only

Correct Answer: storage1 and storage2 only

Explanation: Azure Storage Lifecycle Management is available for blob data and applies to storage accounts configured as StorageV2 (general-purpose v2) and BlobStorage. These account types support lifecycle management policies to automatically transition blobs to different access tiers or delete them based on rules.

  • storage1 (StorageV2 kind): Supported for lifecycle management.
  • storage2 (BlobStorage kind): Supported for lifecycle management.
  • storage3 (FileStorage kind): Not supported, as lifecycle management is not available for FileStorage accounts.

Thus, only storage1 and storage2 can use lifecycle management.

Question 10

You have an Azure Storage account named storage1.

You create the following encryption scopes for storage1:

  • Scope1 that has an encryption type of Microsoft-managed keys
  • Scope2 that has an encryption type of Customer-Managed keys

Which storage services can be used with scope2?

  • blob and file only
  • blob, file, table, and queue
  • blob only
  • file only
  • table and queue only

Correct Answer: Blob and File only

Explanation:

Encryption scopes in Azure Storage allow you to define how data is encrypted in your storage account, using either Microsoft-managed keys or customer-managed keys.

  • Blob Storage and File Storage support Customer-Managed Keys (CMK) for encryption.
  • Table Storage and Queue Storage do not support Customer-Managed Keys and rely only on Microsoft-managed encryption.

Since Scope2 uses Customer-Managed Keys, it is supported only for Blob and File services in the storage account.

Question 11 

You have an Azure storage account named storage1.

You need to ensure that a user named User1 can access storage1 only from January 1st to January 31st 2024.

What should you do?

  • Create a conditional access policy for User1
  • Provide User1 with a shared access signature (SAS)
  • Provide User1 with a storage1 access key
  • Use a condition when assigning User1 an RBAC role on storage1

Correct answer : Provide User1 with a shared access signature (SAS).

Explanation:

  • A Shared Access Signature (SAS) is a time-bound token that provides specific permissions to access Azure Storage resources.
  • You can create a SAS for storage1 and specify the start date as January 1st, 2024, and the end date as January 31st, 2024. This ensures User1 can access the storage account only during that time frame.
  • Other options, such as RBAC or conditional access, cannot directly enforce date-specific access to storage resources like a SAS can.
  • Providing a storage account access key gives unrestricted access without any time limitation, which doesn’t meet the requirement.

Question 12 

You have an Azure subscription that includes a network security group named NSG1.

You plan to add an inbound security rule named Rule1 to NSG1.

You need to configure a priority for Rule1. Rule1 must have the highest priority for inbound security rules in NSG1.

Which priority should you configure for Rule1?  

  • 0
  • 1
  • 10
  • 100
  • 1000

Correct answer: 100

Explanation:

  • In Azure Network Security Groups (NSGs), lower numbers represent higher priorities. The rule with the lowest priority number is processed first.
  • The valid priority range for NSG rules is 100 to 4096.
  • To ensure that Rule1 has the highest priority, you must assign it the lowest valid number in the range, which is 1 in this case.

Question 13

You have an Azure virtual network named VNET1 that is connected to a network security group (NSG) named NSG1. NSG1 has the following inbound security rules:  

  • Rule1 has a priority of 100 and allows port 3389 on TCP protocol from any source and to any destination
  • Rule2 has a priority of 200 and allows ports 80 and 8080 on UDP protocol from any source and to any destination
  • Rule3 has a priority of 300 and denies ports 1-2000 on TCP protocol from any source and to any destination
  • Rule4 has a priority of 400 and allows ports 50-500 on TCP protocol from VirtualNetwork source and to any destination
  • Rule5 has a priority of 500 and allows ports 80 and 443 on TCP protocol from any source and to any destination

You need to allow HTTP and HTTPS connections from the internet to VNET1.

What should you change for NSG1?  

  • Priority for Rule3 to 450
  • Priority for Rule4 to 250
  • Priority for Rule5 to 250
  • Protocol for Rule2 to TCP

Correct Answer: Priority for Rule5 to 250

Explanation:

To allow HTTP (port 80) and HTTPS (port 443) connections from the internet to VNET1:

  1. HTTP and HTTPS traffic is currently allowed by Rule5, but its priority is 500.

    • This means Rule3 (priority 300) takes precedence and denies ports 1–2000 on TCP, blocking HTTP (80) and HTTPS (443) traffic before Rule5 is evaluated.
  2. To ensure HTTP and HTTPS traffic is allowed, Rule5 must have a higher priority than Rule3.

    • Changing the priority of Rule5 to 250 ensures it is evaluated before Rule3.
  3. Changing Rule2’s protocol to TCP will not help because Rule2 pertains to UDP, not TCP, and HTTP/HTTPS use TCP. Similarly, modifying Rule3 or Rule4 priorities won’t address the HTTP/HTTPS traffic requirement.

Question 14:

You have an Azure subscription that contains a storage account named storage1 and the following virtual machines:

  • VM1 has a public IP address of 13.68.158.24 and is connected to VNET1/Subnet1
  • VM2 has a public IP address of 52.255.145.76 and connected to VNET1/Subnet1
  • VM3 has a public IP address of 13.68.158.50 and is connected to VNET1/Subnet2

The subnets have the following service endpoints:

  • Subnet1 has a Microsoft.Storage service endpoint
  • Subnet2 does NOT have any service endpoint

Storage1 has a firewall configured to allow access from the 13.68.158.0/24 IP address range only.

Which virtual machines can access storage1?

  • VM1 and VM2 only
  • VM1 and VM3 only
  • VM1 only
  • VM1, VM2, and VM3
  • VM3 only

Correct Answer: VM1 and VM3 only

Explanation:
  1. Storage Firewall Rule:

    • Storage1’s firewall allows access from the 13.68.158.0/24 IP address range.
    • This range includes the public IP addresses 13.68.158.24 (VM1) and 13.68.158.50 (VM3). It does not include 52.255.145.76 (VM2), so VM2 is excluded.
  2. Service Endpoint in Subnet1:

    • Subnet1 has a Microsoft.Storage service endpoint, which allows VMs in Subnet1 to access the storage account even if the public IP is not whitelisted in the firewall. This enables VM1 (already allowed by its public IP) and VM2 to potentially access Storage1 through the service endpoint.
  3. Subnet2 without Service Endpoint:

    • Subnet2 has no service endpoint for Microsoft.Storage. VM3 can access the storage account only because its public IP is within the allowed range (13.68.158.0/24).

Question 15:

You have an Azure subscription that includes following resources:

  • VNet1, a virtual network
  • Subnet1, a subnet in VNet1
  • VM1, a virtual machine
  • NIC1, a network interface of VM1
  • LB1, a load balancer

You create a network security group named NSG1.

To which two Azure resources can you associate NSG1?

  • LB1
  • NIC1
  • Subnet1
  • VM1
  • VNet1

Correct answers: NIC1 and Subnet1
Explanation:
In Azure, a Network Security Group (NSG) can be associated with:
Network Interfaces (NICs): Associating NSG1 with NIC1 (the network interface of VM1) applies the security rules to traffic directed to and from the NIC.

Subnets:Associating NSG1 with Subnet1 applies the security rules to all resources within the subnet, including NICs connected to it.

Question 16:

You have an Azure subscription that contains the following virtual machines:

  • VM1, a virtual machine that runs Windows Server 2019
  • VM2, a virtual machine that runs Red Hat Enterprise Linux
  • VM3, a virtual machine that is configured with Azure Disk encryption and runs Windows Server 2022

You use Azure Backup to back up the three virtual machines.

Which virtual machine or virtual machines can use file-level restore?

  • VM1 and VM2 only
  • VM1 and VM3 only
  • VM1 only
  • VM1, VM2 and VM3

Correct answer: VM1 and VM2 only

Explanation:

File-level restore in Azure Backup:

Azure Backup supports file-level restore for both Windows and Linux virtual machines.
For Windows VMs, it requires the Azure Backup extension to be installed.
For Linux VMs, file-level restore is supported via a recovery script provided by Azure Backup.

VM1 (Windows Server 2019):

Azure Backup supports file-level restore for Windows VMs unless encryption mechanisms like Azure Disk Encryption (ADE) are enabled.

VM2 (Red Hat Enterprise Linux):

File-level restore is supported for Linux VMs backed up by Azure Backup.

VM3 (Windows Server 2022 with Azure Disk Encryption):

File-level restore is not supported for virtual machines configured with Azure Disk Encryption due to encryption constraints.

Question 17:

You have an Azure subscription that contains an Azure disk named Disk1.

You plan to use Azure Backup to back up Disk1.

What should you deploy first?

  • a Backup vault
  • a Storage account
  • a Recovery Services vault
  • an Azure Backup Server

Correct answer: a Recovery Services vault

Explanation:
  1. Azure Backup requires a Recovery Services vault to store and manage backups of various Azure resources, including Azure disks. The Recovery Services vault acts as the container for backup data and settings.

  2. Why not the other options?:

    • Backup vault: This term is not applicable in Azure. Azure Backup uses a Recovery Services vault, not a “Backup vault.”
    • Storage account: While Azure Backup internally uses storage, you don’t need to create a separate storage account. The Recovery Services vault manages the storage automatically.
    • Azure Backup Server: This is used for on-premises environments, not for native Azure resource backups like disks.
Steps to Back Up Disk1:
  1. Create a Recovery Services vault in the same region as Disk1.
  2. Configure backup policies for Disk1 using the Recovery Services vault.
  3. Enable the backup for Disk1.

Thus, the first step is deploying a Recovery Services vault.

Question 18:

You have a Windows Server Azure virtual machine named VM1. You need to back up two folders in VM1 by using Azure Backup.

The solution should minimize administrative effort. What should you deploy first?

  • Azure Backup Server
  • Recovery Services agent
  • Microsoft Monitoring agent
  • Windows Server Backup role

Correct answer: Recovery Services agent

Explanation:

To back up specific folders on an Azure virtual machine using Azure Backup, you need to install the Recovery Services agent. This agent allows you to configure file- and folder-level backups directly to a Recovery Services vault with minimal effort.

  • Azure Backup Server: Not required for Azure VMs; it’s used for on-premises backups.
  • Microsoft Monitoring agent: Used for monitoring, not for Azure Backup.
  • Windows Server Backup role: Used for local backups, not for Azure Backup.

Question 19:

You recently created an Azure virtual machine standard backup policy.

You need to configure a retention period for virtual machine instant recovery snapshots.

What is the maximum number of days that can be set for the retention period?

  • 5
  • 7
  • 14
  • 30

Correct answer: 5
Explanation:

When using Azure Backup, the maximum retention period for instant recovery snapshots of virtual machines is 5 days. These snapshots are stored locally to enable quick restores, and longer-term retention is managed through the Recovery Services vault for the full backups.

Question 20 :

You have an Azure subscription.

You need to deploy a virtual machine that runs Windows Server 2022 Datacenter: Azure Edition.

Which security type can you select when deploying virtual machine?

  • Standard only
  • Standard or trusted launch only
  • Standard, trusted launch or confidential
  • Trusted launch or confidential only

The correct answer is: Trusted launch or confidential only
Explanation:

When deploying a virtual machine with Windows Server 2022 Datacenter: Azure Edition, you can select either trusted launch or confidential as the security type. These options are designed to enhance the security of the VM by using advanced features:

  • Trusted launch: Provides protection against bootkits and rootkits with secure boot and virtualization-based security (VBS).
  • Confidential: Offers advanced protection using hardware-based Trusted Execution Environments (TEEs), ensuring that data is encrypted in use.

The Standard security type is not available for Windows Server 2022 Datacenter: Azure Edition as it focuses on leveraging enhanced security capabilities.

Question 21:

You have an Azure virtual machine named VM1.

VM1 contains the following:

  • a file named File1 that is stored on volume C:\
  • a file named File2 that is stored on volume D:\
  • an App named App1 that is in a running state
  • a user named User1 that is connected to VM1

You plan to resize VM1.

What is preserved after the resize?  

  • File1 and File2 only
  • File1 and the state of App1 only
  • File1, File2, and the state of App1 only
  • File1, File2, the state of App1, and the connection of User1  
  • File1 only

Correct answer:File1, File2, the state of App1, and the connection of User1

Explanation: When you resize an Azure virtual machine, the following are preserved:

  • File1 and File2: Files stored on the VM’s disks (C:\ and D:) remain intact during resizing.
  • State of App1: The state of running applications can be preserved, as the virtual machine is not being shut down, just resized.
  • Connection of User1: Active user connections typically persist when resizing.

Question 22:

You have an Azure subscription.

You plan to run a data warehouse in an Azure virtual machine named VM1.

You need to ensure that VM1 is optimized for running a data warehouse.

Which VM type should you use for VM1?  

  • Compute optimized (F-Series)
  • General purpose (D-Series)
  • High performance computing (H-Series)
  • Memory optimized (M-Series)
  • Storage optimized (Ls-Series)

Correct answer:Memory optimized (M-Series)

Explanation: For running a data warehouse, which typically requires high memory capacity for processing large amounts of data, memory optimized VMs (such as M-Series) are the best choice. These VMs provide a high amount of memory, which is essential for data-intensive applications like data warehouses.

Other VM types are more suited for different workloads:

  • Compute optimized (F-Series): Best for compute-intensive tasks, not ideal for data warehouses.
  • General purpose (D-Series): A balanced choice but lacks the memory focus required for large-scale data warehouses.
  • High performance computing (H-Series): Optimized for high-performance computing tasks, often used for specialized workloads, not data warehousing.
  • Storage optimized (Ls-Series): Best suited for workloads that need large amounts of storage but not necessarily focused on memory or computational power required by a data warehouse.

Question 23:

You have an Azure subscription and an availability set named AS1 that has 5 update domains.

You deploy 27 virtual machines to AS1.

After a planned update, what is the minimum number of virtual machines that are available?  

  • 14
  • 20
  • 21
  • 22
  • 26

Correct answer:21

Explanation: An availability set in Azure distributes virtual machines (VMs) across update domains and fault domains. The number of update domains determines how many VMs can be updated simultaneously during a planned maintenance event, ensuring that not all VMs are impacted at once.

Given that you have 5 update domains and 27 VMs, Azure will update VMs in batches of 5 update domains at a time. This means that during a planned update, one update domain (i.e., 5 VMs) will be updated at a time. To minimize the impact, 4 update domains will remain unaffected while 1 domain is being updated.

For the minimum number of available VMs after the update:

  • 5 update domains are used.
  • Each update domain can hold a maximum of 5 VMs.
  • At most 1 update domain (5 VMs) will be updated at a time, so 4 update domains (20 VMs) will remain unaffected.

Thus, 27 VMs – 5 VMs (updated domain) = 21 VMs will remain available.

Question 24:

You have a Microsoft Entra tenant.

You create a user named Admin1.

You need to ensure that Admin1 can perform following tasks:

  • Assign licenses to Microsoft Entra groups
  • Reset passwords of Microsoft Entra users

What Microsoft Entra role should you add to Admin1? 

  • Billing Administrator
  • Helpdesk Administrator
  • License Administrator
  • User Administrator

Correct answer:User Administrator

Explanation: The User Administrator role in Microsoft Entra allows users to:

  • Assign licenses to users and groups.
  • Reset passwords for users.

This role covers both the tasks of assigning licenses to Microsoft Entra groups and resetting passwords, which are required in your scenario.

Other roles:

  • Billing Administrator: Manages billing and subscriptions, not user tasks like license assignment or password reset.
  • Helpdesk Administrator: Resets passwords but doesn’t have permissions to assign licenses to groups.
  • License Administrator: Manages licenses, but does not have permissions to reset user passwords.

Question 25:

You have a Microsoft Entra tenant named contoso.com that contains a user named Ben Smith.

You configure a Password protection for contoso.com that includes the following Custom banned passwords settings:  

  • Enforce custom list: Yes
  • Custom banned password list: Contoso

Which password can be used by Ben Smith?  

  • Cont0s0123
  • CONTOSO123
  • Conto123so
  • FgRs01

Correct answer:FgRs01

Explanation: In this scenario, the custom banned password list includes “Contoso” as a banned password. This means any password that contains “Contoso” (in any case) will be blocked.

Here’s why the other options are blocked:

  • Cont0s0123: Contains “Contoso” (even though it’s slightly modified, the system may still recognize it as a banned word).
  • CONTOSO123: Contains “CONTOSO,” which matches the banned word in a different case.
  • Conto123so: Contains “Contoso” in parts, which would still be considered a match to the banned password list.

FgRs01 does not contain the banned word “Contoso,” so it is allowed.

Question 26:

Your company has multiple departments and one Azure subscription. The user accounts for all employees are in the same Microsoft Entra tenant.

You need to delegate permissions for the users in a single department only.

What should you use to organize the user accounts?  

  • administrative unit
  • security group
  • resource group
  • workspace

Correct answer :Administrative unit

Explanation: An administrative unit in Microsoft Entra allows you to organize users, groups, and devices within a specific scope, such as a department or a geographic region, for the purpose of delegating administrative tasks. You can then delegate permissions and management tasks to specific administrators or users for that unit only, without affecting other users in the organization.

Other options:

  • Security group: Used to manage access to resources, but doesn’t provide the granularity needed to delegate administrative permissions.
  • Resource group: Used to organize Azure resources (like VMs, storage, etc.), not user accounts.
  • Workspace: Refers to an Azure Synapse Analytics or Log Analytics workspace, not relevant for organizing user accounts.
Tags:

Leave a Reply