AZ-104 Practice Test 3 – 50 Questions and Answers (Azure Administrator, April 2025 Updated)

Published on

AZ-104 Practice Test 3: 50 Questions and Answers for Azure Administrator

Practice AZ-104 questions covering Microsoft Entra identities and governance, Azure Storage, compute resources, virtual networking, monitoring, and maintenance. Select your answers, review the explanations, and track your progress in the Learning Dashboard.

Exam: AZ-104Questions: 50Recommended score: 70%+Time: 90 minutes

Before you start

This practice test includes single-choice, multiple-response, and true/false questions. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AZ-104 practice test questions

Question 1: Which feature allows temporary elevation of user permissions in Microsoft Entra ID?

The correct answer is Privileged Identity Management.

Privileged Identity Management provides just-in-time access to Microsoft Entra roles, enabling users to elevate their permissions only when needed. This reduces the risk of standing privileged access. It also provides auditing and approval workflows to manage elevated sessions.

Related Microsoft Learn topic

Privileged Identity Management overview

Question 2: What is the purpose of Access Reviews in Microsoft Entra ID?

The correct answer is Review and certify user access.

Access Reviews allow administrators to periodically review user and group memberships to ensure that only the right people have access. This helps maintain least privilege and compliance. It also supports automated reminders and reviewer assignments.

Related Microsoft Learn topic

Access reviews in Microsoft Entra ID

Question 3: Which service synchronizes on-premises Active Directory with Microsoft Entra ID?

The correct answer is Microsoft Entra Connect Sync.

Microsoft Entra Connect Sync is the tool that synchronizes on-premises Active Directory users, groups, and credentials to Microsoft Entra ID. It supports password hash synchronization, pass-through authentication, and federation. This ensures a unified identity across on-premises and cloud.

Related Microsoft Learn topic

Microsoft Entra Connect Sync overview

Question 4: What does Microsoft Entra ID B2B allow?

The correct answer is External user collaboration.

Microsoft Entra ID B2B allows you to invite external partners or contractors to collaborate using their own credentials. It provides secure access to your resources without needing to provision separate accounts. This simplifies managing guest access and maintains security boundaries.

Related Microsoft Learn topic

Manage identities and governance in Azure

Question 5: Which feature enforces multi-factor authentication based on conditions?

The correct answer is Conditional Access.

Conditional Access policies allow you to enforce multi-factor authentication (MFA) based on user, device, location, risk level, or application. This ensures stronger security only when needed. It balances user experience with risk mitigation.

Related Microsoft Learn topic

Conditional Access overview

Question 6: Which role allows delegating only password resets to helpdesk staff?

The correct answer is Helpdesk Administrator.

The Helpdesk Administrator role permits resetting passwords and unlocking accounts but does not grant wider privileges. This restricts the scope of support staff actions to identity help tasks. It maintains principle of least privilege.

Related Microsoft Learn topic

Microsoft Entra built-in roles

Question 7: Which tasks are part of implementing Microsoft Entra Conditional Access? Choose 2 answers.

The correct answers are Define user and group assignments and Specify conditions and controls.

Defining user and group assignments determines who the policy applies to. Specifying conditions and controls sets when the policy is enforced and what actions are required. Together, these tasks form the core of a Conditional Access policy.

Related Microsoft Learn topic

Conditional Access overview

Question 8: Which components are involved in identity governance? Choose 2 answers.

The correct answers are Entitlement Management and Access Reviews.

Entitlement Management automates lifecycle management of identities, groups, and access packages. Access Reviews allow periodic certification of user access. Both components help maintain compliance and governance.

Related Microsoft Learn topic

Access reviews in Microsoft Entra ID

Question 9: Which settings are configured in Microsoft Entra ID Protection? Choose 2 answers.

The correct answers are Risk policies and Sign-in risk levels.

Risk policies define how to respond to detected risks such as requiring MFA or blocking access. Sign-in risk levels categorize the riskiness of each sign-in attempt based on signals. Together, they help protect identities from compromise.

Related Microsoft Learn topic

Microsoft Entra ID Protection overview

Question 10: Privileged Identity Management can provide just-in-time role activation in Azure.

The correct answer is True.

Privileged Identity Management provides just-in-time access to Microsoft Entra roles and Azure resources, allowing users to activate roles for a limited time. This reduces standing privileged access and minimizes risk. It also includes approval workflows and access reviews for better governance.

Related Microsoft Learn topic

Privileged Identity Management overview

Question 11: Microsoft Entra Domain Services require you to manage domain controllers manually.

The correct answer is False.

Microsoft Entra Domain Services provides managed domain controllers so you do not have to administer or patch them yourself. It automatically handles replication and updates. This allows you to use domain services without deploying domain controller VMs.

Related Microsoft Learn topic

Microsoft Entra Domain Services overview

Question 12: Access packages in Entitlement Management can include both applications and SharePoint sites.

The correct answer is True.

Access packages can contain resources such as enterprise applications, Microsoft 365 groups, and SharePoint sites. Users request access to a package, and Entitlement Management automates the process. This simplifies access management across different resource types.

Related Microsoft Learn topic

Entitlement Management overview

Question 13: What is the purpose of Azure File Sync?

The correct answer is Centralize file shares in Azure.

Azure File Sync synchronizes on-premises Windows Server file shares with Azure Files, allowing tiering of older files to the cloud. It provides a consistent namespace for users and reduces on-premises storage needs. It also supports cloud backups.

Related Microsoft Learn topic

Azure File Sync overview

Question 14: Which storage tier is optimized for infrequently accessed data in Azure Blob Storage?

The correct answer is Cool.

The Cool tier is designed for blob data that is infrequently accessed but needs to be available immediately. It offers lower storage costs compared to Hot, with higher access costs. The Archive tier is even cheaper but has higher retrieval latency.

Related Microsoft Learn topic

Access tiers for blob data

Question 15: What feature allows you to mount an Azure Blob container as a file share?

The correct answer is Blobfuse.

Blobfuse is an open-source project that provides a virtual filesystem driver for Azure Blob Storage. It allows Linux clients to mount a blob container as if it were a local file system. This enables applications to access blob storage using POSIX file APIs.

Related Microsoft Learn topic

BlobFuse2 documentation

Question 16: How can you enable automatic data movement between storage tiers?

The correct answer is Configure lifecycle management policies.

Lifecycle management policies allow you to define rules to automatically transition blobs between Hot, Cool, and Archive tiers based on last modified time. This helps optimize costs by moving less-active data to cheaper tiers.

Related Microsoft Learn topic

Access tiers for blob data

Question 17: Which tasks are needed to secure access to an Azure Storage account? Choose 2 answers.

The correct answers are Configure firewall and virtual network rules and Assign built-in roles.

Configuring firewall and VNet rules restricts network access to the storage account. Assigning built-in roles grants or restricts user permissions for storage operations. Together, they secure access at both network and identity levels.

Related Microsoft Learn topic

Configure Azure Storage firewalls and virtual networks

Question 18: Which operations can be performed with Azure Storage Explorer? Choose 2 answers.

The correct answers are Upload blobs and Edit queue messages.

Azure Storage Explorer is a standalone app that allows you to visually manage Azure Storage resources. You can upload, download, and delete blobs; manage queues; and work with table storage. It does not manage network or VM disk resources.

Related Microsoft Learn topic

Azure Storage Explorer

Question 19: Which features support encryption of data at rest in Azure Storage? Choose 2 answers.

The correct answers are Server-side encryption and Client-side encryption.

Server-side encryption automatically encrypts data before storing it and decrypts it when retrieved. Client-side encryption requires you to encrypt data before sending it to Azure. Both methods ensure data is encrypted at rest.

Related Microsoft Learn topic

Azure Storage encryption for data at rest

Question 20: Azure Managed Disks provide encryption by default at rest.

The correct answer is True.

Azure Managed Disks are encrypted at rest using server-side encryption with a Microsoft-managed key by default. You can also use customer-managed keys in Azure Key Vault for added control. This ensures data on the disk is protected against unauthorized access.

Related Microsoft Learn topic

Azure Storage encryption for data at rest

Question 21: Increasing the performance tier for a Premium SSD disk can be done without creating a new disk.

The correct answer is True.

For Premium SSD managed disks, the performance tier can be changed after deployment without creating a new disk. This can be useful when the workload needs higher IOPS or throughput. Always confirm the disk type and any shared-disk restrictions before changing production disks.

Related Microsoft Learn topic

Server-side encryption of Azure Disk Storage

Question 22: Which Azure service provides fully managed Kubernetes clusters?

The correct answer is Azure Kubernetes Service.

AKS provides a managed Kubernetes control plane and automates tasks like patching and scaling. It simplifies container orchestration and integrates with Azure networking and storage. This allows you to focus on your applications rather than cluster management.

Related Microsoft Learn topic

Azure Kubernetes Service overview

Question 23: What service is used to manage infrastructure as code for Azure?

The correct answer is Azure Resource Manager.

ARM templates define Azure resources declaratively as JSON files. They allow you to deploy, update, and manage resources consistently. This ensures repeatable deployments and integrates with CI/CD pipelines for automation.

Related Microsoft Learn topic

Azure Resource Manager overview

Question 24: How can you resize a virtual machine in Azure?

The correct answer is Select a new VM size in the Azure portal.

You can resize a VM by choosing a different size that meets your performance requirements. Resizing may require the VM to be stopped and deallocated. The portal guides you through the available sizes for the VM's series.

Related Microsoft Learn topic

Change the size of a virtual machine

Question 25: Which feature allows you to deploy multiple VMs based on a single image?

The correct answer is Shared Image Gallery.

A Shared Image Gallery lets you create and manage custom VM images, and replicate them across regions. You can version images and use them to deploy scale sets or individual VMs consistently. This streamlines large-scale image management.

Related Microsoft Learn topic

Azure Compute Gallery overview

Question 26: What is Azure Bastion primarily used for?

The correct answer is Secure RDP/SSH without public IP.

Azure Bastion provides a managed jump-box service in the Azure Portal that allows you to connect to VMs over SSL via RDP or SSH. It eliminates the need for exposing VM public IPs. This reduces attack surface and improves security.

Related Microsoft Learn topic

Azure Bastion overview

Question 27: Which Azure Disk type is best for mission-critical workloads?

The correct answer is Ultra Disk.

Ultra Disks deliver sub-millisecond latency and high IOPS for performance-sensitive workloads. They allow dynamic performance adjustments independently of VM size. This makes them ideal for databases and high-performance applications.

Related Microsoft Learn topic

Azure Ultra Disk overview

Question 28: Which tasks are part of configuring Azure VM availability? Choose 2 answers.

The correct answers are Create an availability set and Deploy availability zones.

An availability set distributes VMs across fault and update domains to avoid single points of failure. Availability zones replicate resources across separate physical locations in a region. Both approaches enhance VM resilience.

Related Microsoft Learn topic

Availability options for Azure Virtual Machines

Question 29: Which capabilities are provided by Azure Virtual Machine Scale Sets? Choose 2 answers.

The correct answers are Automatic scaling and Built-in load balancing.

VM Scale Sets allow you to define a set of identical VMs that automatically scale in or out based on metrics. They also integrate with Azure Load Balancer or Application Gateway for distributing traffic across VM instances.

Related Microsoft Learn topic

Virtual Machine Scale Sets overview

Question 30: Which resources might you configure to support high performance compute workloads? Choose 2 answers.

The correct answers are High performance GPU VMs and Azure Batch.

GPU VMs are designed for intensive compute tasks like AI and rendering. Azure Batch provides job scheduling and scaling for large parallel workloads. Together, they support HPC scenarios effectively.

Related Microsoft Learn topic

GPU optimized virtual machine sizes

Question 31: You can attach up to 32 data disks to a single Azure VM.

The correct answer is True.

Azure VMs support attaching up to 32 data disks, depending on the VM series. Each attached data disk appears as a logical drive inside the VM. This allows you to expand storage capacity or separate data volumes for performance.

Related Microsoft Learn topic

Attach a managed data disk to a Windows VM

Question 32: Azure Dedicated Host is used to reserve physical servers for your VMs.

The correct answer is True.

Azure Dedicated Host provides physical servers that host only your Azure VMs. This ensures server-level isolation for compliance and licensing requirements. You maintain control over VM placement and can map to existing on-premises server-based licensing.

Related Microsoft Learn topic

Azure Dedicated Host overview

Question 33: Azure Availability Zones require VMs to be in separate subscriptions.

The correct answer is False.

Availability Zones are physical locations within an Azure region. You can deploy VMs in different zones under the same subscription and region. This provides high availability without needing multiple subscriptions.

Related Microsoft Learn topic

Availability zones for Azure Virtual Machines

Question 34: Which Azure service helps manage DNS records?

The correct answer is Azure DNS.

Azure DNS hosts DNS domains and provides name resolution using Microsoft’s global network. You can manage DNS records with the Azure portal or CLI. It integrates with Azure resource management to simplify name resolution for Azure resources.

Related Microsoft Learn topic

Azure Bastion overview

Question 35: What is the purpose of an Azure Application Gateway?

The correct answer is Layer 7 load balancing.

Application Gateway provides application-level routing and load balancing based on HTTP(S). It also supports SSL termination, URL-based routing, and the Web Application Firewall. This helps secure and optimize web applications.

Related Microsoft Learn topic

Azure Application Gateway overview

Question 36: Which Azure feature provides distributed denial-of-service protection?

The correct answer is Azure DDoS Protection.

Azure DDoS Protection defends against volumetric, protocol, and resource layer attacks. It automatically monitors traffic patterns and mitigates identified threats. This protects your Azure resources from external DDoS attacks.

Related Microsoft Learn topic

Azure DDoS Protection overview

Question 37: What does Azure Front Door help with?

The correct answer is Global load balancing.

Azure Front Door is a global, scalable entry point that uses Microsoft's global network to route HTTP(S) traffic to the fastest and most available application backend. It also provides SSL offload, path-based routing, and caching.

Related Microsoft Learn topic

Azure Front Door overview

Question 38: Which components are part of a hub-spoke network topology in Azure? Choose 2 answers.

The correct answers are Virtual network peerings and ExpressRoute circuits.

Virtual network peering connects hub and spoke VNets to allow resource communication. ExpressRoute circuits enable private connectivity from on-premises to the hub VNet. Together, they form a central hub for network traffic and connectivity.

Related Microsoft Learn topic

Azure Application Gateway overview

Question 39: Which tasks are involved in configuring a VPN Gateway? Choose 2 answers.

The correct answers are Create a virtual network gateway and Define gateway subnet.

The gateway subnet is a dedicated subnet for the VPN Gateway. Creating the virtual network gateway deploys the gateway resource. Establishing a local network gateway is also common, but the two core tasks are the gateway and its subnet.

Related Microsoft Learn topic

Azure VPN Gateway overview

Question 40: Which actions can be used to restrict inbound traffic to a subnet? Choose 2 answers.

The correct answers are Associate Network Security Group and Configure Azure Firewall rules.

NSGs define allow/deny rules at the subnet or NIC level. Azure Firewall provides a managed, cloud-based network security service. Both options restrict and filter inbound traffic effectively.

Related Microsoft Learn topic

Azure DDoS Protection overview

Question 41: Azure Route Server simplifies dynamic routing between your network virtual appliance and virtual networks.

The correct answer is True.

Azure Route Server enables you to exchange routing information between your network virtual appliance (NVA) and the Azure virtual network dynamically using BGP. This simplifies connecting NVAs and automates route management. It reduces manual route configuration.

Related Microsoft Learn topic

Azure Route Server overview

Question 42: ExpressRoute connections traverse the public internet.

The correct answer is False.

ExpressRoute provides a private, dedicated connection between your on-premises network and Azure datacenters, bypassing the public internet. This results in more reliable, faster connections with lower latencies and increased security. It is used for enterprise workloads requiring high throughput.

Related Microsoft Learn topic

Azure ExpressRoute overview

Question 43: Which Azure service would you use to centralize logs from multiple subscriptions?

The correct answer is Azure Log Analytics workspace.

A Log Analytics workspace collects and stores log data from multiple Azure services and subscriptions. You can run queries across all collected data to analyze and visualize it. This helps with troubleshooting and monitoring.

Related Microsoft Learn topic

Log Analytics workspace overview

Question 44: What is the primary purpose of Azure Service Health?

The correct answer is Notify about Azure service incidents and maintenance.

Azure Service Health alerts you to service issues affecting your resources, planned maintenance, and health advisories. It provides personalized alerts and guidance to mitigate issues. This helps you stay informed about platform events.

Related Microsoft Learn topic

Azure Service Health overview

Question 45: Which feature allows you to visualize metrics on a custom dashboard?

The correct answer is Azure Monitor Metrics Explorer.

Metrics Explorer lets you chart and visualize performance metrics from various resources. You can pin charts to Azure dashboards to create custom views. This helps you track resource health and performance in one place.

Related Microsoft Learn topic

Analyze metrics with Azure Monitor metrics explorer

Question 46: Which of the following tasks are part of monitoring Azure resources? Choose 2 answers.

The correct answers are Interpreting metrics in Azure Monitor and Querying and analyzing logs.

These activities are essential for understanding resource performance. They help in early detection of anomalies and potential issues. This monitoring is vital for proactive maintenance and optimization.

Related Microsoft Learn topic

Azure Monitor overview

Question 47: Which actions can be performed using Azure Network Watcher? Choose 2 answers.

The correct answers are Monitor network connectivity and Capture network traffic.

Azure Network Watcher provides diagnostic tools for network issues. It enables you to capture packets and analyze network flows. This is essential for troubleshooting and maintaining network health.

Related Microsoft Learn topic

Azure Network Watcher overview

Question 48: Azure Monitor Insights provides detailed monitoring for virtual machines, storage accounts, and networks.

The correct answer is True.

Azure Monitor Insights aggregates data from various resources to deliver in-depth analysis. It helps in identifying performance bottlenecks and optimizing operations. This detailed monitoring is essential for maintaining a healthy infrastructure.

Related Microsoft Learn topic

Azure Monitor overview

Question 49: Azure Backup can be used to perform failover to a secondary region.

The correct answer is False.

Azure Backup is used for backup and restore. Failover to a secondary region is handled by Azure Site Recovery for disaster recovery replication and failover. Backup and failover are different recovery patterns, so choosing the right service matters for business continuity planning.

Related Microsoft Learn topic

Azure Site Recovery overview

Question 50: Azure Site Recovery is used only for on-premises disaster recovery and not for Azure resources.

The correct answer is False.

Azure Site Recovery supports disaster recovery for both on-premises and Azure resources. It enables seamless failover to a secondary site in case of disruptions. This versatility makes it an essential tool for comprehensive business continuity planning.

Related Microsoft Learn topic

Azure Site Recovery overview

Comments

Post a Comment