COURSE CODE: AZ-104
EXAM DATE TIME ALLOWED
COURSE TITLE: Microsoft Azure Administrator — 2026/2027
— / — / —— 180 Minutes
INSTRUCTOR: —
◇
Microsoft AZ-104 — 2026/2027
Comprehensive Azure Administrator Examination
ALL QUESTIONS ARE COMPULSORY
A MULTIPLE CHOICE & SCENARIO QUESTIONS (120 Marks)
Choose the single best answer for each question. Write the correct letter in the space provided.
1. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
virtual networks. Solution: From the Resource providers blade, you unregister the
Microsoft.ClassicNetwork provider. Does this meet the goal?
A. Yes
B. No
◆
✦ CORRECT ANSWER: B. No
Rationale: Unregistering the ClassicNetwork provider does not enforce NSG rules. Azure Policy must be used to enforce specific
NSG configurations.
2. You need to create groups for users that are automatically deleted after 180 days. Which two groups
should you create?
A. Security group with Assigned membership
B. Office 365 group with Assigned membership and Office 365 group with Dynamic User membership
C. Distribution group
D. Mail-enabled security group
◆
✦ CORRECT ANSWER: B. Office 365 group with Assigned membership and Office 365 group with Dynamic User membership
Rationale: Office 365 groups support expiration policies that automatically delete groups after a specified period, such as 180
days.
, 3. User3 is the owner of Group1. Group2 is a member of Group1. Can User3 perform an access review of
User1, UserA, and UserB?
A. Yes for all three
B. No for all three
C. Yes for User1 and UserA, No for UserB
D. Yes for User1 only
◆
✦ CORRECT ANSWER: A. Yes for all three
Rationale: As owner of Group1, User3 can review all members including nested group members (Group2 contains UserA and
UserB).
4. You need to copy D:\Folder1 contents to a public Azure blob container named contosodata. Which
command should you run?
A. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
B. azcopy sync D:\folder1 https://contosodata.file.core.windows.net/public
C. xcopy D:\folder1 https://contosodata.blob.core.windows.net/public
D. robocopy D:\folder1 \\contosodata.blob.core.windows.net\public
◆
✦ CORRECT ANSWER: A. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
Rationale: AzCopy with the copy command and --recursive flag copies folder contents to Azure Blob storage.
5. Which UNC path references files from an Azure file share named data in storage account
contosostorage?
A. \\contosostorage.file.core.windows.net\data
B. \\contosostorage.blob.core.windows.net\data
C. \\contosostorage.queue.core.windows.net\data
D. \\contosostorage.table.core.windows.net\data
◆
✦ CORRECT ANSWER: A. \\contosostorage.file.core.windows.net\data
Rationale: Azure Files uses the format \\storageaccount.file.core.windows.net\sharename.
, 6. With Azure Policy restricting virtual networks in a management group hierarchy, can you create a
VNet in Subscription1 under ManagementGroup21?
A. Yes
B. No
◆
✦ CORRECT ANSWER: B. No
Rationale: The policy "Not allowed resource types: VirtualNetworks" assigned to ManagementGroup11 propagates down to
ManagementGroup21, blocking VNet creation in Subscription1.
7. A VM has NSG rules: Rule2 (ports 50-60), Default-allow-rdp, Rule1 (ports 50-500 TCP). Internet users
can currently connect to which services?
A. Only the web server
B. Web server and DNS server
C. Only RDP
D. No services
◆
✦ CORRECT ANSWER: A. Only the web server
Rationale: Rule1 allows TCP 50-500 which includes web (80/443) but DNS uses TCP/UDP 53 which falls under Rule2's Any
protocol. Deleting Rule2 opens DNS access.
8. After swapping staging and production slots for a web app experiencing performance issues, what is
the fastest way to revert?
A. Redeploy from backup
B. Swap the slots again
C. Restore from snapshot
D. Scale up the App Service plan
◆
✦ CORRECT ANSWER: B. Swap the slots again
Rationale: Swapping slots back returns the previous production slot (now staging) to production immediately with no downtime.
EXAM DATE TIME ALLOWED
COURSE TITLE: Microsoft Azure Administrator — 2026/2027
— / — / —— 180 Minutes
INSTRUCTOR: —
◇
Microsoft AZ-104 — 2026/2027
Comprehensive Azure Administrator Examination
ALL QUESTIONS ARE COMPULSORY
A MULTIPLE CHOICE & SCENARIO QUESTIONS (120 Marks)
Choose the single best answer for each question. Write the correct letter in the space provided.
1. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
virtual networks. Solution: From the Resource providers blade, you unregister the
Microsoft.ClassicNetwork provider. Does this meet the goal?
A. Yes
B. No
◆
✦ CORRECT ANSWER: B. No
Rationale: Unregistering the ClassicNetwork provider does not enforce NSG rules. Azure Policy must be used to enforce specific
NSG configurations.
2. You need to create groups for users that are automatically deleted after 180 days. Which two groups
should you create?
A. Security group with Assigned membership
B. Office 365 group with Assigned membership and Office 365 group with Dynamic User membership
C. Distribution group
D. Mail-enabled security group
◆
✦ CORRECT ANSWER: B. Office 365 group with Assigned membership and Office 365 group with Dynamic User membership
Rationale: Office 365 groups support expiration policies that automatically delete groups after a specified period, such as 180
days.
, 3. User3 is the owner of Group1. Group2 is a member of Group1. Can User3 perform an access review of
User1, UserA, and UserB?
A. Yes for all three
B. No for all three
C. Yes for User1 and UserA, No for UserB
D. Yes for User1 only
◆
✦ CORRECT ANSWER: A. Yes for all three
Rationale: As owner of Group1, User3 can review all members including nested group members (Group2 contains UserA and
UserB).
4. You need to copy D:\Folder1 contents to a public Azure blob container named contosodata. Which
command should you run?
A. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
B. azcopy sync D:\folder1 https://contosodata.file.core.windows.net/public
C. xcopy D:\folder1 https://contosodata.blob.core.windows.net/public
D. robocopy D:\folder1 \\contosodata.blob.core.windows.net\public
◆
✦ CORRECT ANSWER: A. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
Rationale: AzCopy with the copy command and --recursive flag copies folder contents to Azure Blob storage.
5. Which UNC path references files from an Azure file share named data in storage account
contosostorage?
A. \\contosostorage.file.core.windows.net\data
B. \\contosostorage.blob.core.windows.net\data
C. \\contosostorage.queue.core.windows.net\data
D. \\contosostorage.table.core.windows.net\data
◆
✦ CORRECT ANSWER: A. \\contosostorage.file.core.windows.net\data
Rationale: Azure Files uses the format \\storageaccount.file.core.windows.net\sharename.
, 6. With Azure Policy restricting virtual networks in a management group hierarchy, can you create a
VNet in Subscription1 under ManagementGroup21?
A. Yes
B. No
◆
✦ CORRECT ANSWER: B. No
Rationale: The policy "Not allowed resource types: VirtualNetworks" assigned to ManagementGroup11 propagates down to
ManagementGroup21, blocking VNet creation in Subscription1.
7. A VM has NSG rules: Rule2 (ports 50-60), Default-allow-rdp, Rule1 (ports 50-500 TCP). Internet users
can currently connect to which services?
A. Only the web server
B. Web server and DNS server
C. Only RDP
D. No services
◆
✦ CORRECT ANSWER: A. Only the web server
Rationale: Rule1 allows TCP 50-500 which includes web (80/443) but DNS uses TCP/UDP 53 which falls under Rule2's Any
protocol. Deleting Rule2 opens DNS access.
8. After swapping staging and production slots for a web app experiencing performance issues, what is
the fastest way to revert?
A. Redeploy from backup
B. Swap the slots again
C. Restore from snapshot
D. Scale up the App Service plan
◆
✦ CORRECT ANSWER: B. Swap the slots again
Rationale: Swapping slots back returns the previous production slot (now staging) to production immediately with no downtime.
