COURSE CODE: AZ-104-ADV
EXAM DATE TIME ALLOWED
COURSE TITLE: Microsoft Azure Administrator — Advanced 2026/2027
— / — / —— 180 Minutes
INSTRUCTOR: —
◇
Microsoft AZ-104 — Advanced 2026/2027
Comprehensive Azure Administrator Examination (Questions 135–270)
ALL QUESTIONS ARE COMPULSORY
A MULTIPLE CHOICE & SCENARIO QUESTIONS (136 Marks)
Choose the single best answer for each question. Write the correct letter in the space provided.
1. You need to discover virtual machines using Azure Migrate Collector. Which TCP ports should be
allowed on the firewalls?
A. Inbound 80, Inbound 995
B. Outbound 3389, Outbound 443
C. Inbound 443, Outbound 80
D. Inbound 3389, Outbound 995
◆
✦ CORRECT ANSWER: B. Outbound 3389, Outbound 443
Rationale: Azure Migrate Collector requires outbound HTTPS (443) for data transfer to Azure and WinRM (5985/5986) or RDP
(3389) depending on discovery method for VMware VMs.
, 2. You need to ensure a Logic App can query an on-premises SQL Server. Which three actions should
you perform in sequence?
A. From Azure portal, create on-prem data gateway; From on-prem computer, install gateway; From Logic Apps
Designer, add connector
B. Create Azure VM; Install gateway on VM; Add connector
C. Install gateway on-premises; From Azure portal, create gateway resource; From Logic Apps Designer, add connector
D. Create connector first; Install gateway; Register gateway
◆
✦ CORRECT ANSWER: C. Install gateway on-premises; From Azure portal, create gateway resource; From Logic Apps Designer,
add connector
Rationale: The correct sequence is: install the on-premises data gateway on a local computer, create the gateway resource in
Azure, then add the connector in Logic Apps Designer.
3. To create a conditional access policy requiring MFA for Azure portal access, which three settings
should you configure?
A. Users and Groups, Cloud Apps, Grant
B. Users and Groups, Conditions, Session
C. Cloud Apps, Conditions, Session
D. Users and Groups, Cloud Apps, Session
◆
✦ CORRECT ANSWER: A. Users and Groups, Cloud Apps, Grant
Rationale: Conditional access policy requires: Assignments (Users and Groups + Cloud Apps) and Access Controls (Grant —
requiring MFA).
4. You need to identify a security rule preventing network packets and validate outbound connectivity.
Which Network Watcher features should you use?
A. IP flow verify for both tasks
B. IP flow verify for Task1; Connection troubleshoot for Task2
C. Next hop for Task1; Traffic Analytics for Task2
D. Packet capture for both tasks
◆
✦ CORRECT ANSWER: B. IP flow verify for Task1; Connection troubleshoot for Task2
Rationale: IP flow verify identifies which NSG rule blocks/permits traffic. Connection troubleshoot validates outbound
connectivity to external hosts.
, 5. You need to move a VM with managed disks to another subscription with minimal administration
effort. What should you do first?
A. Create a copy of the virtual disk in the target subscription
B. Run Move-AzureRmResource cmdlet
C. Create a snapshot of the virtual disk
D. Create a new virtual machine in the target subscription
◆
✦ CORRECT ANSWER: B. Run Move-AzureRmResource cmdlet
Rationale: The Move-AzureRmResource cmdlet moves resources between subscriptions with minimal effort, especially for VMs
with managed disks.
6. You need to associate each VM in RG1 to a specific cost center (Manufacturing, Sales, Finance). What
should you do?
A. Add an extension to the VMs
B. Modify inventory settings
C. Assign tags to the virtual machines
D. Configure locks for the VMs
◆
✦ CORRECT ANSWER: C. Assign tags to the virtual machines
Rationale: Azure tags enable cost center attribution and appear in billing and cost management reports.
7. An Azure policy excludes ContosoRG1 and denies Microsoft.Sql/servers. Which statement is true?
A. You can create Azure SQL servers in ContosoRG1
B. You are prevented from creating SQL servers anywhere in Subscription 1
C. You are prevented from creating SQL servers in ContosoRG1 only
D. You can create SQL servers in any resource group
◆
✦ CORRECT ANSWER: A. You can create Azure SQL servers in ContosoRG1
Rationale: The policy denies SQL servers everywhere except the excluded resource group ContosoRG1.
, 8. You plan to transfer 5 TB of data using Azure Import/Export. What can you use as the destination?
A. Azure SQL Database
B. Azure Data Factory
C. A virtual machine
D. Azure Blob storage
◆
✦ CORRECT ANSWER: D. Azure Blob storage
Rationale: Azure Import/Export service imports data into Azure Blob storage or Azure Files only.
9. You need to identify unattached disks that can be deleted from 100 VMs. What should you do?
A. View Account Management properties in Storage Explorer
B. Configure Advisor recommendations
C. From Azure Cost Management, open the Optimizer tab and create a report
D. Create a Cost Management report
◆
✦ CORRECT ANSWER: C. From Azure Cost Management, open the Optimizer tab and create a report
Rationale: Cost Management's Optimizer identifies orphaned (unattached) managed disks that can be deleted to reduce costs.
10. VM1 needs to move to a different host due to maintenance. Does moving the VM to a different
subscription meet the goal?
A. Yes
B. No
◆
✦ CORRECT ANSWER: B. No
Rationale: Moving subscriptions does not change the physical host. Use the Redeploy option to move to a different Azure host.
EXAM DATE TIME ALLOWED
COURSE TITLE: Microsoft Azure Administrator — Advanced 2026/2027
— / — / —— 180 Minutes
INSTRUCTOR: —
◇
Microsoft AZ-104 — Advanced 2026/2027
Comprehensive Azure Administrator Examination (Questions 135–270)
ALL QUESTIONS ARE COMPULSORY
A MULTIPLE CHOICE & SCENARIO QUESTIONS (136 Marks)
Choose the single best answer for each question. Write the correct letter in the space provided.
1. You need to discover virtual machines using Azure Migrate Collector. Which TCP ports should be
allowed on the firewalls?
A. Inbound 80, Inbound 995
B. Outbound 3389, Outbound 443
C. Inbound 443, Outbound 80
D. Inbound 3389, Outbound 995
◆
✦ CORRECT ANSWER: B. Outbound 3389, Outbound 443
Rationale: Azure Migrate Collector requires outbound HTTPS (443) for data transfer to Azure and WinRM (5985/5986) or RDP
(3389) depending on discovery method for VMware VMs.
, 2. You need to ensure a Logic App can query an on-premises SQL Server. Which three actions should
you perform in sequence?
A. From Azure portal, create on-prem data gateway; From on-prem computer, install gateway; From Logic Apps
Designer, add connector
B. Create Azure VM; Install gateway on VM; Add connector
C. Install gateway on-premises; From Azure portal, create gateway resource; From Logic Apps Designer, add connector
D. Create connector first; Install gateway; Register gateway
◆
✦ CORRECT ANSWER: C. Install gateway on-premises; From Azure portal, create gateway resource; From Logic Apps Designer,
add connector
Rationale: The correct sequence is: install the on-premises data gateway on a local computer, create the gateway resource in
Azure, then add the connector in Logic Apps Designer.
3. To create a conditional access policy requiring MFA for Azure portal access, which three settings
should you configure?
A. Users and Groups, Cloud Apps, Grant
B. Users and Groups, Conditions, Session
C. Cloud Apps, Conditions, Session
D. Users and Groups, Cloud Apps, Session
◆
✦ CORRECT ANSWER: A. Users and Groups, Cloud Apps, Grant
Rationale: Conditional access policy requires: Assignments (Users and Groups + Cloud Apps) and Access Controls (Grant —
requiring MFA).
4. You need to identify a security rule preventing network packets and validate outbound connectivity.
Which Network Watcher features should you use?
A. IP flow verify for both tasks
B. IP flow verify for Task1; Connection troubleshoot for Task2
C. Next hop for Task1; Traffic Analytics for Task2
D. Packet capture for both tasks
◆
✦ CORRECT ANSWER: B. IP flow verify for Task1; Connection troubleshoot for Task2
Rationale: IP flow verify identifies which NSG rule blocks/permits traffic. Connection troubleshoot validates outbound
connectivity to external hosts.
, 5. You need to move a VM with managed disks to another subscription with minimal administration
effort. What should you do first?
A. Create a copy of the virtual disk in the target subscription
B. Run Move-AzureRmResource cmdlet
C. Create a snapshot of the virtual disk
D. Create a new virtual machine in the target subscription
◆
✦ CORRECT ANSWER: B. Run Move-AzureRmResource cmdlet
Rationale: The Move-AzureRmResource cmdlet moves resources between subscriptions with minimal effort, especially for VMs
with managed disks.
6. You need to associate each VM in RG1 to a specific cost center (Manufacturing, Sales, Finance). What
should you do?
A. Add an extension to the VMs
B. Modify inventory settings
C. Assign tags to the virtual machines
D. Configure locks for the VMs
◆
✦ CORRECT ANSWER: C. Assign tags to the virtual machines
Rationale: Azure tags enable cost center attribution and appear in billing and cost management reports.
7. An Azure policy excludes ContosoRG1 and denies Microsoft.Sql/servers. Which statement is true?
A. You can create Azure SQL servers in ContosoRG1
B. You are prevented from creating SQL servers anywhere in Subscription 1
C. You are prevented from creating SQL servers in ContosoRG1 only
D. You can create SQL servers in any resource group
◆
✦ CORRECT ANSWER: A. You can create Azure SQL servers in ContosoRG1
Rationale: The policy denies SQL servers everywhere except the excluded resource group ContosoRG1.
, 8. You plan to transfer 5 TB of data using Azure Import/Export. What can you use as the destination?
A. Azure SQL Database
B. Azure Data Factory
C. A virtual machine
D. Azure Blob storage
◆
✦ CORRECT ANSWER: D. Azure Blob storage
Rationale: Azure Import/Export service imports data into Azure Blob storage or Azure Files only.
9. You need to identify unattached disks that can be deleted from 100 VMs. What should you do?
A. View Account Management properties in Storage Explorer
B. Configure Advisor recommendations
C. From Azure Cost Management, open the Optimizer tab and create a report
D. Create a Cost Management report
◆
✦ CORRECT ANSWER: C. From Azure Cost Management, open the Optimizer tab and create a report
Rationale: Cost Management's Optimizer identifies orphaned (unattached) managed disks that can be deleted to reduce costs.
10. VM1 needs to move to a different host due to maintenance. Does moving the VM to a different
subscription meet the goal?
A. Yes
B. No
◆
✦ CORRECT ANSWER: B. No
Rationale: Moving subscriptions does not change the physical host. Use the Redeploy option to move to a different Azure host.
