AZ-104 MICROSOFT AZURE
ADMINISTRATOR | 200+ EXAM
QUESTIONS & ANSWERS | AZURE AD,
RBAC, STORAGE, NETWORKING,
SECURITY & MONITORING |
MICROSOFT AZURE CERTIFICATION
1. You need to require multifactor authentication only when users sign in from
outside trusted locations. What should you use?
A. Access review
B. Conditional Access policy
C. Privileged Identity Management
D. Microsoft Entra ID Protection
Answer: B. Conditional Access policy. Rationale: Conditional Access evaluates signals
such as user/group, location, device, and risk, then enforces controls like MFA. Access
reviews recertify access, PIM manages eligible roles, and ID Protection detects risk.
2. You have a resource group named RG1. You must prevent resources in RG1
from being deleted, but users must still be able to modify existing resources.
What should you apply?
A. Reader role
B. Read-only lock
C. CanNotDelete lock
D. Azure Policy deny effect
Answer: C. CanNotDelete lock. Rationale: A CanNotDelete lock prevents deletion while
still allowing read and update operations. Read-only locks prevent modifications. RBAC
Reader only grants read access.
,3. You store blobs in a general-purpose v2 storage account. You need to
automatically move blobs to Cool after 30 days and to Archive after 180 days.
What should you configure?
A. Blob lifecycle management policy
B. Blob soft delete
C. Storage account firewall
D. Immutable blob storage
Answer: A. Blob lifecycle management policy. Rationale: Lifecycle management rules
can transition blobs between Hot, Cool, Cold, and Archive tiers based on age or last
access. Soft delete is for recovery, firewall controls network access, and immutability
prevents changes/deletion.
4. You need to connect an on-premises network to an Azure virtual network by
using a private, dedicated connection that does not traverse the public internet.
What should you use?
A. Site-to-Site VPN
B. Point-to-Site VPN
C. Azure ExpressRoute
D. Azure Bastion
Answer: C. Azure ExpressRoute. Rationale: ExpressRoute provides a private dedicated
connection through a connectivity provider. VPN gateways use the public internet.
Azure Bastion provides secure RDP/SSH access to VMs.
5. You have several VMs in a subnet. The VMs need outbound internet access,
but they must not receive inbound connections from the internet. What should
you deploy?
A. Azure Firewall
B. NAT gateway
C. Application security group
D. Service endpoint
Answer: B. NAT gateway. Rationale: NAT gateway provides scalable outbound SNAT for
subnets and does not allow unsolicited inbound traffic from the internet. Azure Firewall
,can also provide outbound control, but NAT gateway is the simplest fit for outbound-
only access.
6. You need to grant a user the ability to manage all resources in a single
resource group, but not resources in other resource groups. What should you
do?
A. Assign the Contributor role at the subscription scope
B. Assign the Owner role at the resource group scope
C. Assign the Contributor role at the resource group scope
D. Assign the Reader role at the subscription scope
Answer: C. Assign the Contributor role at the resource group scope. Rationale:
Contributor can create and manage resources but cannot grant access. Assigning it at
the resource group scope limits permissions to that resource group.
7. You need to ensure that only approved marketplace images can be deployed
in a subscription. What should you use?
A. Azure Policy
B. Resource lock
C. RBAC role assignment
D. Management group
Answer: A. Azure Policy. Rationale: Azure Policy can audit or deny deployments that do
not meet conditions, such as allowed marketplace image publishers or SKUs. Locks
prevent deletion/modification, RBAC controls who can act, and management groups
organize subscriptions.
8. You need to be alerted when a VM’s CPU usage exceeds 80% for 5 minutes.
What should you configure?
A. Azure Monitor alert rule
B. Log Analytics workspace
C. Network Watcher
D. Azure Advisor
, Answer: A. Azure Monitor alert rule. Rationale: Azure Monitor metrics alerts can trigger
when a metric such as Percentage CPU crosses a threshold over a specified time
window. Log Analytics stores/query logs, Network Watcher monitors network traffic,
and Advisor gives recommendations.
9. You need to back up Azure VMs to a vault and retain backups for 90 days.
What should you create first?
A. Recovery Services vault
B. Storage account
C. Automation account
D. Log Analytics workspace
Answer: A. Recovery Services vault. Rationale: Azure Backup uses a Recovery Services
vault to store backup data and retention policies for IaaS VMs and other workloads. A
storage account is not the primary backup vault for Azure VM backup.
10. You need to allow a team to deploy VMs only in the East US region. What is
the most appropriate solution?
A. Azure Policy with an allowed locations rule
B. Resource lock on the resource group
C. Conditional Access policy
D. Network security group rule
Answer: A. Azure Policy with an allowed locations rule. Rationale: Azure Policy can
restrict the regions where resources can be deployed. Locks do not control region
choice, Conditional Access controls sign-in, and NSGs control network traffic.
11. You need to automatically add users to a group when their department
changes to “Sales.” What should you create?
A. Assigned security group
B. Dynamic user group
C. Dynamic device group
D. Administrative unit
Answer: B. Dynamic user group. Rationale: Dynamic user groups use attribute-based
membership rules, such as department equals Sales.
ADMINISTRATOR | 200+ EXAM
QUESTIONS & ANSWERS | AZURE AD,
RBAC, STORAGE, NETWORKING,
SECURITY & MONITORING |
MICROSOFT AZURE CERTIFICATION
1. You need to require multifactor authentication only when users sign in from
outside trusted locations. What should you use?
A. Access review
B. Conditional Access policy
C. Privileged Identity Management
D. Microsoft Entra ID Protection
Answer: B. Conditional Access policy. Rationale: Conditional Access evaluates signals
such as user/group, location, device, and risk, then enforces controls like MFA. Access
reviews recertify access, PIM manages eligible roles, and ID Protection detects risk.
2. You have a resource group named RG1. You must prevent resources in RG1
from being deleted, but users must still be able to modify existing resources.
What should you apply?
A. Reader role
B. Read-only lock
C. CanNotDelete lock
D. Azure Policy deny effect
Answer: C. CanNotDelete lock. Rationale: A CanNotDelete lock prevents deletion while
still allowing read and update operations. Read-only locks prevent modifications. RBAC
Reader only grants read access.
,3. You store blobs in a general-purpose v2 storage account. You need to
automatically move blobs to Cool after 30 days and to Archive after 180 days.
What should you configure?
A. Blob lifecycle management policy
B. Blob soft delete
C. Storage account firewall
D. Immutable blob storage
Answer: A. Blob lifecycle management policy. Rationale: Lifecycle management rules
can transition blobs between Hot, Cool, Cold, and Archive tiers based on age or last
access. Soft delete is for recovery, firewall controls network access, and immutability
prevents changes/deletion.
4. You need to connect an on-premises network to an Azure virtual network by
using a private, dedicated connection that does not traverse the public internet.
What should you use?
A. Site-to-Site VPN
B. Point-to-Site VPN
C. Azure ExpressRoute
D. Azure Bastion
Answer: C. Azure ExpressRoute. Rationale: ExpressRoute provides a private dedicated
connection through a connectivity provider. VPN gateways use the public internet.
Azure Bastion provides secure RDP/SSH access to VMs.
5. You have several VMs in a subnet. The VMs need outbound internet access,
but they must not receive inbound connections from the internet. What should
you deploy?
A. Azure Firewall
B. NAT gateway
C. Application security group
D. Service endpoint
Answer: B. NAT gateway. Rationale: NAT gateway provides scalable outbound SNAT for
subnets and does not allow unsolicited inbound traffic from the internet. Azure Firewall
,can also provide outbound control, but NAT gateway is the simplest fit for outbound-
only access.
6. You need to grant a user the ability to manage all resources in a single
resource group, but not resources in other resource groups. What should you
do?
A. Assign the Contributor role at the subscription scope
B. Assign the Owner role at the resource group scope
C. Assign the Contributor role at the resource group scope
D. Assign the Reader role at the subscription scope
Answer: C. Assign the Contributor role at the resource group scope. Rationale:
Contributor can create and manage resources but cannot grant access. Assigning it at
the resource group scope limits permissions to that resource group.
7. You need to ensure that only approved marketplace images can be deployed
in a subscription. What should you use?
A. Azure Policy
B. Resource lock
C. RBAC role assignment
D. Management group
Answer: A. Azure Policy. Rationale: Azure Policy can audit or deny deployments that do
not meet conditions, such as allowed marketplace image publishers or SKUs. Locks
prevent deletion/modification, RBAC controls who can act, and management groups
organize subscriptions.
8. You need to be alerted when a VM’s CPU usage exceeds 80% for 5 minutes.
What should you configure?
A. Azure Monitor alert rule
B. Log Analytics workspace
C. Network Watcher
D. Azure Advisor
, Answer: A. Azure Monitor alert rule. Rationale: Azure Monitor metrics alerts can trigger
when a metric such as Percentage CPU crosses a threshold over a specified time
window. Log Analytics stores/query logs, Network Watcher monitors network traffic,
and Advisor gives recommendations.
9. You need to back up Azure VMs to a vault and retain backups for 90 days.
What should you create first?
A. Recovery Services vault
B. Storage account
C. Automation account
D. Log Analytics workspace
Answer: A. Recovery Services vault. Rationale: Azure Backup uses a Recovery Services
vault to store backup data and retention policies for IaaS VMs and other workloads. A
storage account is not the primary backup vault for Azure VM backup.
10. You need to allow a team to deploy VMs only in the East US region. What is
the most appropriate solution?
A. Azure Policy with an allowed locations rule
B. Resource lock on the resource group
C. Conditional Access policy
D. Network security group rule
Answer: A. Azure Policy with an allowed locations rule. Rationale: Azure Policy can
restrict the regions where resources can be deployed. Locks do not control region
choice, Conditional Access controls sign-in, and NSGs control network traffic.
11. You need to automatically add users to a group when their department
changes to “Sales.” What should you create?
A. Assigned security group
B. Dynamic user group
C. Dynamic device group
D. Administrative unit
Answer: B. Dynamic user group. Rationale: Dynamic user groups use attribute-based
membership rules, such as department equals Sales.
