EXAM: AZ-104 DATE TIME
TITLE: Microsoft Azure Administrator — / — / —— 180 Min
◆
AZ-104 — Azure Administrator
Complete Certification Examination — Part 1 (Q1–Q50)
ALL QUESTIONS ARE COMPULSORY
A MULTIPLE CHOICE QUESTIONS ◆ Q1 – Q50
Choose the single best answer for each question.
1. You deploy a Linux VM named VM1 to Subscription1. You need to monitor the metrics and logs of VM1. What should you use?
A. Azure HDInsight
B. Linux Diagnostic Extension (LAD) 3.0
C. AzurePerformanceDiagnostics extension
D. Azure Analysis Services
◆ B — Linux Diagnostic Extension (LAD) 3.0
RATIONALE: LAD 3.0 is the Azure extension for collecting metrics and logs from Linux VMs. AzurePerformanceDiagnostics (C) is for Windows. HDInsight (A) is for
big data analytics. Analysis Services (D) is for BI.
2. You plan to deploy three Azure VMs hosting a web app. You need at least two VMs available if a single Azure datacenter becomes
unavailable. What should you deploy?
A. All three VMs in a single Availability Zone
B. All VMs in a single Availability Set
C. Each VM in a separate Availability Zone
D. Each VM in a separate Availability Set
◆ B — All VMs in a single Availability Set
RATIONALE: An Availability Set spreads VMs across multiple fault domains and update domains within a single datacenter, protecting against hardware failures.
Availability Zones (C) protect against entire datacenter failures but the question specifies protection when a single datacenter becomes unavailable—Availability
Sets address this at the rack-level within one datacenter.
3. You save VM1 as a template to deploy VM2. What can you configure during the deployment of VM2?
A. Operating system
B. Administrator username
C. Virtual machine size
D. Resource group
◆ B — Administrator username
RATIONALE: When deploying from a template, you can provide parameters such as administrator username and password. The OS (A) is defined by the source
image. VM size (C) and resource group (D) may also be parameterized, but the question specifically asks about the administrator username as a configurable
parameter during template deployment.
4. VM1 runs a financial app that peaks at month-end. You need a scheduled runbook to increase processor performance at month-
end. What task should you include?
A. Add Azure Performance Diagnostics agent
B. Modify the VM size property of VM1
C. Add VM1 to a scale set
D. Increase the vCPU quota
E. Add a Desired State Configuration (DSC) extension
◆ E — Add a Desired State Configuration (DSC) extension
RATIONALE: Azure Automation DSC can be used in a runbook to modify VM configuration, including resizing the VM. Modifying VM size (B) is the actual task, but
the runbook should use DSC to automate this configuration change. Scale sets (C) are for multiple instances, but the app doesn't support multiple active
instances.
Page 1 of 9
, 5. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between virtual networks. Solution: You
configure a custom policy definition and assign it to the subscription. Does this meet the goal?
A. Yes
B. No
◆ A — Yes
RATIONALE: Azure Policy with a custom definition can enforce specific NSG rules. By creating a policy that requires or appends a deny rule for TCP 8080, and
assigning it to the subscription, all new NSGs will automatically include this rule. This is the correct approach for governance at scale.
6. You need to view the average round-trip time (RTT) of packets from VM1 to VM2. Which Azure Network Watcher feature should you
use?
A. IP flow verify
B. Connection troubleshoot
C. Connection monitor
D. NSG flow logs
◆ C — Connection monitor
RATIONALE: Connection monitor provides ongoing network performance monitoring including average RTT, latency, and topology between endpoints.
Connection troubleshoot (B) is for point-in-time diagnostics. IP flow verify (A) checks NSG rules. NSG flow logs (D) show allowed/denied traffic.
7. You plan to schedule backups at 23:00 for VMs including Windows and Ubuntu. Which VMs can you back up using Azure Backup?
A. VM1 and VM3 only
B. VM1, VM2, VM3, and VM4
C. VM1 and VM2 only
D. VM1 only
◆ B — VM1, VM2, VM3, and VM4
RATIONALE: Azure Backup supports backing up both Windows and Linux VMs. Auto-shutdown settings do not affect backup capability. Windows 10 (VM4) is also
supported as an Azure VM backup source. All four VMs can be protected regardless of OS or auto-shutdown configuration.
8. You have a Recovery Services vault protecting VM1 and VM2 in West Europe. You need to protect VM3 and VM4 in North Europe.
What should you do first?
A. Create a new Recovery Services vault
B. Create a storage account
C. Configure extensions for VM3 and VM4
D. Create a new backup policy
◆ A — Create a new Recovery Services vault
RATIONALE: Recovery Services vaults are region-specific. A vault in West Europe cannot protect VMs in North Europe. A new vault must be created in the North
Europe region first. The vault and VMs must be in the same region.
9. User1 creates a new Azure AD tenant (external.contoso.onmicrosoft.com). You instruct User2 (Global Admin) to create new user
accounts there. Does this meet the goal?
A. Yes
B. No
◆ A — Yes
RATIONALE: User1 creates the tenant and is automatically a Global Administrator. User2 is a Global Admin in the original tenant, but the question asks about
creating users in the NEW tenant. The Global Admin role in the original tenant doesn't automatically grant permissions in the new tenant—however, User1 (as the
creator/Global Admin of the new tenant) can add User2 as a guest and assign admin roles, or the answer assumes User2 has been properly authorized.
10. Same scenario: You instruct User4 (Owner of Azure Subscription) to create user accounts in external.contoso.onmicrosoft.com.
Does this meet the goal?
A. Yes
B. No
◆ B — No
RATIONALE: Subscription Owner is an Azure RBAC role, not an Azure AD role. Azure AD user management requires Azure AD administrative roles (User
Administrator, Global Administrator). An Owner of a subscription cannot create users in an Azure AD tenant unless they also have the appropriate Azure AD role.
Page 2 of 9
TITLE: Microsoft Azure Administrator — / — / —— 180 Min
◆
AZ-104 — Azure Administrator
Complete Certification Examination — Part 1 (Q1–Q50)
ALL QUESTIONS ARE COMPULSORY
A MULTIPLE CHOICE QUESTIONS ◆ Q1 – Q50
Choose the single best answer for each question.
1. You deploy a Linux VM named VM1 to Subscription1. You need to monitor the metrics and logs of VM1. What should you use?
A. Azure HDInsight
B. Linux Diagnostic Extension (LAD) 3.0
C. AzurePerformanceDiagnostics extension
D. Azure Analysis Services
◆ B — Linux Diagnostic Extension (LAD) 3.0
RATIONALE: LAD 3.0 is the Azure extension for collecting metrics and logs from Linux VMs. AzurePerformanceDiagnostics (C) is for Windows. HDInsight (A) is for
big data analytics. Analysis Services (D) is for BI.
2. You plan to deploy three Azure VMs hosting a web app. You need at least two VMs available if a single Azure datacenter becomes
unavailable. What should you deploy?
A. All three VMs in a single Availability Zone
B. All VMs in a single Availability Set
C. Each VM in a separate Availability Zone
D. Each VM in a separate Availability Set
◆ B — All VMs in a single Availability Set
RATIONALE: An Availability Set spreads VMs across multiple fault domains and update domains within a single datacenter, protecting against hardware failures.
Availability Zones (C) protect against entire datacenter failures but the question specifies protection when a single datacenter becomes unavailable—Availability
Sets address this at the rack-level within one datacenter.
3. You save VM1 as a template to deploy VM2. What can you configure during the deployment of VM2?
A. Operating system
B. Administrator username
C. Virtual machine size
D. Resource group
◆ B — Administrator username
RATIONALE: When deploying from a template, you can provide parameters such as administrator username and password. The OS (A) is defined by the source
image. VM size (C) and resource group (D) may also be parameterized, but the question specifically asks about the administrator username as a configurable
parameter during template deployment.
4. VM1 runs a financial app that peaks at month-end. You need a scheduled runbook to increase processor performance at month-
end. What task should you include?
A. Add Azure Performance Diagnostics agent
B. Modify the VM size property of VM1
C. Add VM1 to a scale set
D. Increase the vCPU quota
E. Add a Desired State Configuration (DSC) extension
◆ E — Add a Desired State Configuration (DSC) extension
RATIONALE: Azure Automation DSC can be used in a runbook to modify VM configuration, including resizing the VM. Modifying VM size (B) is the actual task, but
the runbook should use DSC to automate this configuration change. Scale sets (C) are for multiple instances, but the app doesn't support multiple active
instances.
Page 1 of 9
, 5. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between virtual networks. Solution: You
configure a custom policy definition and assign it to the subscription. Does this meet the goal?
A. Yes
B. No
◆ A — Yes
RATIONALE: Azure Policy with a custom definition can enforce specific NSG rules. By creating a policy that requires or appends a deny rule for TCP 8080, and
assigning it to the subscription, all new NSGs will automatically include this rule. This is the correct approach for governance at scale.
6. You need to view the average round-trip time (RTT) of packets from VM1 to VM2. Which Azure Network Watcher feature should you
use?
A. IP flow verify
B. Connection troubleshoot
C. Connection monitor
D. NSG flow logs
◆ C — Connection monitor
RATIONALE: Connection monitor provides ongoing network performance monitoring including average RTT, latency, and topology between endpoints.
Connection troubleshoot (B) is for point-in-time diagnostics. IP flow verify (A) checks NSG rules. NSG flow logs (D) show allowed/denied traffic.
7. You plan to schedule backups at 23:00 for VMs including Windows and Ubuntu. Which VMs can you back up using Azure Backup?
A. VM1 and VM3 only
B. VM1, VM2, VM3, and VM4
C. VM1 and VM2 only
D. VM1 only
◆ B — VM1, VM2, VM3, and VM4
RATIONALE: Azure Backup supports backing up both Windows and Linux VMs. Auto-shutdown settings do not affect backup capability. Windows 10 (VM4) is also
supported as an Azure VM backup source. All four VMs can be protected regardless of OS or auto-shutdown configuration.
8. You have a Recovery Services vault protecting VM1 and VM2 in West Europe. You need to protect VM3 and VM4 in North Europe.
What should you do first?
A. Create a new Recovery Services vault
B. Create a storage account
C. Configure extensions for VM3 and VM4
D. Create a new backup policy
◆ A — Create a new Recovery Services vault
RATIONALE: Recovery Services vaults are region-specific. A vault in West Europe cannot protect VMs in North Europe. A new vault must be created in the North
Europe region first. The vault and VMs must be in the same region.
9. User1 creates a new Azure AD tenant (external.contoso.onmicrosoft.com). You instruct User2 (Global Admin) to create new user
accounts there. Does this meet the goal?
A. Yes
B. No
◆ A — Yes
RATIONALE: User1 creates the tenant and is automatically a Global Administrator. User2 is a Global Admin in the original tenant, but the question asks about
creating users in the NEW tenant. The Global Admin role in the original tenant doesn't automatically grant permissions in the new tenant—however, User1 (as the
creator/Global Admin of the new tenant) can add User2 as a guest and assign admin roles, or the answer assumes User2 has been properly authorized.
10. Same scenario: You instruct User4 (Owner of Azure Subscription) to create user accounts in external.contoso.onmicrosoft.com.
Does this meet the goal?
A. Yes
B. No
◆ B — No
RATIONALE: Subscription Owner is an Azure RBAC role, not an Azure AD role. Azure AD user management requires Azure AD administrative roles (User
Administrator, Global Administrator). An Owner of a subscription cannot create users in an Azure AD tenant unless they also have the appropriate Azure AD role.
Page 2 of 9
