Microsoft Certified: Azure
Administrator Associate AZ103
TEST QUESTIONS LATEST UPDATE 2026
You are always responsible for: - ANSWER-1 Data
2 Endpoints
3 Accounts
4 Access
Azure Security Center tiers: - ANSWER-Free
Standard - $15 a month per node
Authentication (AuthN) - ANSWER-Process of establishing identity of a person or
service. Includes act of challenging party for their creds. Establishes they ARE who they
say they are.
Authorization (AuthZ) - ANSWER-Establishes what access you are allowed
Azure MFA for global admins is: - ANSWER-Free
Azure MFA for non-global admins is: - ANSWER-Not free. Requires specific license
Identity - ANSWER-A thing that can be authenticated: Users, Servers, Services, Apps
Principle - ANSWER-An identity with certain roles: Sudo or CMD as an admin. Role
changes even with identity staying the same. Groups are another example or principles
Service Principle - ANSWER-Identity used by a service or application. Can be assigned
roles.
Role-Based Access Control (RBAC) - ANSWER-Roles are sets of permissions, users
are assigned to roles; users are assigned to groups and the group are assigned to
roles. Like editor or read only. Can be granted to access an Azure service instance
Privileged Identity Management (PIM) - ANSWER-A paid for service that provides
oversight of role assignments, self-service and just in time role activation
Symmetric encryption - ANSWER-Uses a single key to encrypt and decrypt data.
,Asymmetric encryption - ANSWER-Two keys are used; one key encodes the message,
and the other key decodes the message. Used for Transport Layer Security (TLS) which
is used for HTTPS and data signing
Azure Storage Service Encryption - ANSWER-Data at rest encryption. Used for Blob
storage, Azure files, etc
Azure Disk Encryption - ANSWER-Encrypts windows or linux IaaS VM disks. Uses
bitlocker feature of Windows and the dm-crypt feature of Linux to provide encryption for
the OS and data disk. Integrated into Azure Key Vault
Transport Data Encryption (TDE) - ANSWER-Helps protect Azure SQL database and
Azure Data Warehouse. Enabled by default. You can use Azure Key Vault key or bring
your own key (BYOK)
Azure Key Vault - ANSWER-- Secret management, tokens, passwords, certs, API keys
etc.
- Key management, encryption keys
- Certificate management, manage and use your SSL/TLS certs for your Azure and
internally connected services
- Store secrets backed by hardware security modules (HSM). Can use software or FIPS
HSM
Benefits of Azure Key Vault include - ANSWER-- Centralized app secrets
- Securely stored secrets and keys
- Monitor access and use
- Simplify admin of app secrets
- Integrate with other Azure services
X.509 v3 - ANSWER-Certs used in Azure
Firewall - ANSWER-Grants access based on IP. Can check port and protocol also
Azure Firewall - ANSWER-Managed. Cloud based. Fully stateful. Built with high
availability and unrestricted cloud scalability. Protects against inbound non-HTTP/S
protocols like RDP, SSH and FTP.
Also provides outbound network level protection for all ports and protocols and
application level protection for outbound HTTP/S
Azure App Gateway - ANSWER-A load balancer that includes a Web App Firewall
(WAF) that protects against common known vulnerabilities in websites. Designed for
HTTP traffic
Network Virtual Appliance (NVA) - ANSWER-Ideal options for non-HTTP services on
advanced configurations. Similar to hardware firewalls
,Azure DDoS protection - ANSWER-Monitors traffic at the Azure network edge before it
effects availability.
It identifies DDoS traffic and blocks it while allowing legit traffic
Azure DDoS Protection: Basic tier - ANSWER-Auto enabled in Azure. Always on
monitoring. Real time monitoring/mitigation of common network level attacks.
Azure DDoS protection: Standard tier - ANSWER-Additional mitigation capabilities
tuned specifically to Azure Virtual Network resources. Requires no app changes.
Dedicated traffic monitoring. Machine learning. Mitigate against: volumetric attacks,
protocol attacks, resource layer attacks
Volumetric Attacks - ANSWER-Attackers goal is to flood network layer with a substantial
amount of seemingly legit traffic
Protocol Attacks - ANSWER-Render a target inaccessible by exploiting a weakness in
layer 3 and 4 protocol stacks
Resource (App) Layer Attacks - ANSWER-Target web app packets to disrupt traffic and
transmission of data between hosts
Fault domain max value - ANSWER-2-3 depending on the region you are in
Update domain max value - ANSWER-20
(Higher number means fewer of their nodes in any given availability set would be
rebooted at once)
You need to associate virtual machines to a specific cost center. What should you do? -
ANSWER-Assign tags to the virtual machines
Assign tags to the virtual machines - ANSWER-
You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user
accounts.You create a new user account named AdminUser1.You need to assign the
User administrator administrative role to AdminUser1.What should you do from the user
account properties? - ANSWER-From the Directory role blade, modify the directory role.
What is used to customize a Linux VM on first boot up - ANSWER-Cloud-init.txt
In an alert rule you create, emailreceiver value "Action1" will send how many email
alerts per hour - ANSWER-60 - One alert per minute will trigger one email per minute
In an alert rule you create, smsreceiver value: "Action1" will send how many SMS alerts
- ANSWER-12 - No more than 1 SMS every 5 minutes can be send, which equals 12
per hour.
, You have an on-premises virtual machine named VM1. You need to ensure that you
can use the disks attached to VM1 as a template for Azure virtual machines. Which
section of the VM settings should you modify?
Processor
Hard Drive
Network Adapters
Integration Services - ANSWER-Hard Drive
You have an Azure subscription that is used by four departments in your company. The
subscription contains 10 resource groups. Each department uses resources in several
resource groups.You need to send a report to the finance department. The report must
detail the costs for each department.Which three actions should you perform in
sequence? - ANSWER-1. Assign a tag to each resource
2. From the cost Analysis blade, filter the view by tag
3. Download the usage report
Your company has an Azure subscription named Subscription1.The company also has
two on-premises servers named Server1 and Server2 that run Windows Server 2016.
Server1 is configured as a DNS server that has a primary DNS zone named
adatum.com. Adatum.com contains 1,000 DNS records.You manage Server1 and
Subscription1 from Server2. Server2 has the following tools installed:
- The Azure Portal
- The DNS Manager console
- Azure PowerShell
- Azure CLI 2.0
You need to move the adatum.com zone to Subscription1. The solution must minimize
administrative effort.What should you use? - ANSWER-Azure CLI - Azure DNS supports
importing and exporting zone files by using the Azure command-line interface (CLI).
Zone file import is not currently supported via AzurePowerShell or the Azure portal.
Virtual nic's can be associated with how many NSG's? - ANSWER-0 or 1. No more
Vnet peering - ANSWER-way to connect azure virtual networks together within azure
Gateway transit - ANSWER-Function that allows vnet peering through one network to
get to another. Example, network A can talk to network C *through* network B using
gateway transit
VNet-to-VNet (for azure to on prem, or vnet to vnet) - ANSWER-Create VNets and
subnets
Create gateway subnet
Create the VPN gateway
Create the local network gateway
Administrator Associate AZ103
TEST QUESTIONS LATEST UPDATE 2026
You are always responsible for: - ANSWER-1 Data
2 Endpoints
3 Accounts
4 Access
Azure Security Center tiers: - ANSWER-Free
Standard - $15 a month per node
Authentication (AuthN) - ANSWER-Process of establishing identity of a person or
service. Includes act of challenging party for their creds. Establishes they ARE who they
say they are.
Authorization (AuthZ) - ANSWER-Establishes what access you are allowed
Azure MFA for global admins is: - ANSWER-Free
Azure MFA for non-global admins is: - ANSWER-Not free. Requires specific license
Identity - ANSWER-A thing that can be authenticated: Users, Servers, Services, Apps
Principle - ANSWER-An identity with certain roles: Sudo or CMD as an admin. Role
changes even with identity staying the same. Groups are another example or principles
Service Principle - ANSWER-Identity used by a service or application. Can be assigned
roles.
Role-Based Access Control (RBAC) - ANSWER-Roles are sets of permissions, users
are assigned to roles; users are assigned to groups and the group are assigned to
roles. Like editor or read only. Can be granted to access an Azure service instance
Privileged Identity Management (PIM) - ANSWER-A paid for service that provides
oversight of role assignments, self-service and just in time role activation
Symmetric encryption - ANSWER-Uses a single key to encrypt and decrypt data.
,Asymmetric encryption - ANSWER-Two keys are used; one key encodes the message,
and the other key decodes the message. Used for Transport Layer Security (TLS) which
is used for HTTPS and data signing
Azure Storage Service Encryption - ANSWER-Data at rest encryption. Used for Blob
storage, Azure files, etc
Azure Disk Encryption - ANSWER-Encrypts windows or linux IaaS VM disks. Uses
bitlocker feature of Windows and the dm-crypt feature of Linux to provide encryption for
the OS and data disk. Integrated into Azure Key Vault
Transport Data Encryption (TDE) - ANSWER-Helps protect Azure SQL database and
Azure Data Warehouse. Enabled by default. You can use Azure Key Vault key or bring
your own key (BYOK)
Azure Key Vault - ANSWER-- Secret management, tokens, passwords, certs, API keys
etc.
- Key management, encryption keys
- Certificate management, manage and use your SSL/TLS certs for your Azure and
internally connected services
- Store secrets backed by hardware security modules (HSM). Can use software or FIPS
HSM
Benefits of Azure Key Vault include - ANSWER-- Centralized app secrets
- Securely stored secrets and keys
- Monitor access and use
- Simplify admin of app secrets
- Integrate with other Azure services
X.509 v3 - ANSWER-Certs used in Azure
Firewall - ANSWER-Grants access based on IP. Can check port and protocol also
Azure Firewall - ANSWER-Managed. Cloud based. Fully stateful. Built with high
availability and unrestricted cloud scalability. Protects against inbound non-HTTP/S
protocols like RDP, SSH and FTP.
Also provides outbound network level protection for all ports and protocols and
application level protection for outbound HTTP/S
Azure App Gateway - ANSWER-A load balancer that includes a Web App Firewall
(WAF) that protects against common known vulnerabilities in websites. Designed for
HTTP traffic
Network Virtual Appliance (NVA) - ANSWER-Ideal options for non-HTTP services on
advanced configurations. Similar to hardware firewalls
,Azure DDoS protection - ANSWER-Monitors traffic at the Azure network edge before it
effects availability.
It identifies DDoS traffic and blocks it while allowing legit traffic
Azure DDoS Protection: Basic tier - ANSWER-Auto enabled in Azure. Always on
monitoring. Real time monitoring/mitigation of common network level attacks.
Azure DDoS protection: Standard tier - ANSWER-Additional mitigation capabilities
tuned specifically to Azure Virtual Network resources. Requires no app changes.
Dedicated traffic monitoring. Machine learning. Mitigate against: volumetric attacks,
protocol attacks, resource layer attacks
Volumetric Attacks - ANSWER-Attackers goal is to flood network layer with a substantial
amount of seemingly legit traffic
Protocol Attacks - ANSWER-Render a target inaccessible by exploiting a weakness in
layer 3 and 4 protocol stacks
Resource (App) Layer Attacks - ANSWER-Target web app packets to disrupt traffic and
transmission of data between hosts
Fault domain max value - ANSWER-2-3 depending on the region you are in
Update domain max value - ANSWER-20
(Higher number means fewer of their nodes in any given availability set would be
rebooted at once)
You need to associate virtual machines to a specific cost center. What should you do? -
ANSWER-Assign tags to the virtual machines
Assign tags to the virtual machines - ANSWER-
You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user
accounts.You create a new user account named AdminUser1.You need to assign the
User administrator administrative role to AdminUser1.What should you do from the user
account properties? - ANSWER-From the Directory role blade, modify the directory role.
What is used to customize a Linux VM on first boot up - ANSWER-Cloud-init.txt
In an alert rule you create, emailreceiver value "Action1" will send how many email
alerts per hour - ANSWER-60 - One alert per minute will trigger one email per minute
In an alert rule you create, smsreceiver value: "Action1" will send how many SMS alerts
- ANSWER-12 - No more than 1 SMS every 5 minutes can be send, which equals 12
per hour.
, You have an on-premises virtual machine named VM1. You need to ensure that you
can use the disks attached to VM1 as a template for Azure virtual machines. Which
section of the VM settings should you modify?
Processor
Hard Drive
Network Adapters
Integration Services - ANSWER-Hard Drive
You have an Azure subscription that is used by four departments in your company. The
subscription contains 10 resource groups. Each department uses resources in several
resource groups.You need to send a report to the finance department. The report must
detail the costs for each department.Which three actions should you perform in
sequence? - ANSWER-1. Assign a tag to each resource
2. From the cost Analysis blade, filter the view by tag
3. Download the usage report
Your company has an Azure subscription named Subscription1.The company also has
two on-premises servers named Server1 and Server2 that run Windows Server 2016.
Server1 is configured as a DNS server that has a primary DNS zone named
adatum.com. Adatum.com contains 1,000 DNS records.You manage Server1 and
Subscription1 from Server2. Server2 has the following tools installed:
- The Azure Portal
- The DNS Manager console
- Azure PowerShell
- Azure CLI 2.0
You need to move the adatum.com zone to Subscription1. The solution must minimize
administrative effort.What should you use? - ANSWER-Azure CLI - Azure DNS supports
importing and exporting zone files by using the Azure command-line interface (CLI).
Zone file import is not currently supported via AzurePowerShell or the Azure portal.
Virtual nic's can be associated with how many NSG's? - ANSWER-0 or 1. No more
Vnet peering - ANSWER-way to connect azure virtual networks together within azure
Gateway transit - ANSWER-Function that allows vnet peering through one network to
get to another. Example, network A can talk to network C *through* network B using
gateway transit
VNet-to-VNet (for azure to on prem, or vnet to vnet) - ANSWER-Create VNets and
subnets
Create gateway subnet
Create the VPN gateway
Create the local network gateway
