AZ-104 Azure Administrator Practice Questions with Explanations
Free AZ-104 Azure Administrator practice questions with an explanation for every answer. Covers identity and governance, storage, compute, virtual networking, and monitoring and backup in Microsoft Azure.
Questions
A user must create and manage every resource in a resource group but must NOT be able to grant access to anyone else. Which built-in role fits?
- Contributor
- Owner
- User Access Administrator
- Reader
Which built-in role lets a user manage who has access to Azure resources, without letting them create or change the resources themselves?
- User Access Administrator
- Contributor
- Owner
- Reader
Which list orders Azure RBAC scopes from broadest to narrowest?
- Management group, subscription, resource group, resource
- Subscription, management group, resource group, resource
- Resource group, subscription, management group, resource
- Management group, resource group, subscription, resource
Maria has Reader at the subscription scope and Contributor on resource group RG1. What can she do in RG1?
- Create and change resources in RG1
- Only view the resources in RG1
- Nothing, because Reader at a higher scope wins
- Assign roles to other users in RG1
A group has Contributor on a resource group. A new VM is later created in that resource group. What access does the group have to the VM?
- Contributor, inherited from the resource group
- None until someone assigns a role on the VM itself
- Reader only, because inherited roles are downgraded
- Contributor, but only after the VM is tagged
Where in the portal can you quickly see what roles a specific user has on a resource?
- Access control (IAM) > Check access
- Azure Advisor recommendations
- The subscription's Cost analysis blade
- Azure Policy > Compliance
A company must ensure no one in any subscription can create resources outside East US. What should you use?
- Azure Policy with the Allowed locations definition
- A Reader role assignment at every subscription scope
- A ReadOnly lock on every resource group
- A required Region tag on each resource group
Which Azure Policy effect stops a noncompliant resource from being created?
- Deny
- Audit
- Append
- Disabled
Which Azure Policy effect allows the resource to be created but marks it noncompliant in the compliance report?
- Audit
- Deny
- Modify
- DeployIfNotExists
What is a set of Azure Policy definitions grouped so they can be assigned together as one unit?
- An initiative
- A management group
- A role definition
- A resource lock
You assign a policy with the DeployIfNotExists effect. New resources comply, but existing resources stay noncompliant. What should you create?
- A remediation task
- A ReadOnly resource lock
- A budget with an action group
- A new custom RBAC role
Which lock type prevents deletion but still allows users to modify the resource?
- Delete (CanNotDelete)
- ReadOnly
- Deny assignment
- Audit
A subscription Owner tries to delete a resource group that has a Delete lock. What happens?
- The delete fails until the lock is removed
- The delete succeeds because Owner overrides locks
- The group is deleted but the lock is kept
- Only resources without tags are deleted
A ReadOnly lock is placed on a storage account. Which side effect will admins most likely notice?
- They can no longer list the account access keys
- Blobs become read-only for anonymous users only
- The account is converted to LRS redundancy
- Storage costs move to the archive tier
A lock applied to a resource group also applies to the resources inside it.
You tag a resource group with Dept=Finance. Do the resources inside it automatically get that tag?
- No. Use Azure Policy to inherit the tag
- Yes, tags always flow down to resources
- Yes, but only for resources created after tagging
- No, and tags cannot be copied to resources
What is the maximum number of tag name/value pairs on a single Azure resource?
- 50
- 15
- 100
- 10
What is the main reason organizations apply tags such as CostCenter and Environment?
- To group and report costs and resources by category
- To isolate network traffic between department subnets
- To encrypt the data stored in each resource
- To set role permissions for each department
How many resource groups can a single resource belong to at the same time?
- Exactly one
- Up to two
- As many as needed
- None; resource groups are optional
Deleting a resource group deletes all of the resources inside it.
A resource group is located in East US. Can it contain a VM in West Europe?
- Yes. The group's location only stores its metadata
- No. Every resource must be in its resource group's region
- Only if the two regions are peered
- Only for storage accounts, not VMs
How many levels deep can a management group hierarchy go, not counting the root level or the subscription level?
- Six
- Three
- Ten
- Unlimited
What is the main purpose of management groups?
- Apply policy and access across many subscriptions
- Group VMs behind a single load balancer
- Store activity logs for longer than the 90-day default
- Replicate storage accounts to another region
A subscription budget reaches 100% of its amount. What happens by default?
- An alert is sent and resources keep running
- All running resources are stopped
- The subscription is disabled until next month
- Further spending is blocked at the limit
Which Azure Advisor category would recommend shutting down or resizing underused VMs?
- Cost
- Security
- Reliability
- Performance
A partner company's employee needs access to your resources using their own work account. What should you do?
- Invite them as a Microsoft Entra B2B guest
- Create a member account and share its password
- Assign them a system-assigned managed identity
- Add them to your on-premises AD domain first
You want every user whose Department is Sales added to a group automatically. Which group membership type do you use?
- Dynamic user
- Assigned
- Dynamic device
- Administrative unit
What licensing do dynamic membership groups in Microsoft Entra ID require?
- Microsoft Entra ID P1 or higher
- The Free edition included with Azure
- No license of any kind
- An Azure DevOps Basic license
Assigning a Microsoft 365 license to a new user fails. Which user property is most likely missing?
- Usage location
- Job title
- Manager
- Office phone
What is the most efficient way to license 200 new employees who are all in one department group?
- Assign the license to the group
- Assign the license to each user
- Apply a resource lock to the group
- Assign an Azure Policy to the tenant
Which two group types can you create in Microsoft Entra ID?
- Security and Microsoft 365
- Distribution and Dynamic
- Owner and Member
- Local and Domain
When enabling self-service password reset (SSPR), which scope options are available?
- None, Selected, or All
- Basic, Standard, or Premium
- Users, Guests, or Devices
- Global, Regional, or Local
Which SSPR authentication method is NOT available to administrator accounts?
- Security questions
- Mobile app notification
- Mobile phone
You need to create 300 users in Microsoft Entra ID from the portal in one operation. What do you use?
- Bulk create with a CSV template
- An Azure Policy initiative
- Azure Resource Graph Explorer
- A management group assignment
For how long can a deleted user in Microsoft Entra ID be restored?
- 30 days
- 7 days
- 90 days
- 365 days
A subscription is transferred to a different Microsoft Entra tenant. What happens to its Azure role assignments?
- They are removed and must be recreated
- They are kept exactly as they were
- They are converted into guest accounts
- They are converted into Azure Policy
Which of these are Azure RBAC roles for resources, as opposed to Microsoft Entra directory roles?
- Owner
- Contributor
- Reader
- Global Administrator
- User Administrator
An Azure subscription trusts exactly one Microsoft Entra tenant at a time.
In a custom role definition, which property lists where the role can be assigned?
- AssignableScopes
- Actions
- NotActions
- DataActions
Which built-in role lets a user manage VMs but not the virtual network or storage account the VMs connect to?
- Virtual Machine Contributor
- Network Contributor
- Storage Account Contributor
- Reader
How does locally redundant storage (LRS) protect data?
- Three copies in a single datacenter
- Three copies across three availability zones
- Six copies across two regions
- Two copies in a single datacenter
Data must survive the loss of one datacenter, but company policy says it must never leave the primary region. Which redundancy fits?
- ZRS
- LRS
- GRS
- RA-GRS
How many copies of your data does geo-redundant storage (GRS) keep in total?
- Six
- Three
- Four
- Nine
An app must be able to read data from the secondary region at all times, without waiting for a failover. Which option fits?
- RA-GRS
- GRS
- ZRS
- LRS
Which redundancy option protects against both a zone outage in the primary region and a full regional outage?
- GZRS
- ZRS
- LRS
- GRS
Which blob access tier has the lowest storage cost but is offline and can take hours before data can be read?
- Archive
- Cold
- Cool
- Hot
What is the minimum storage duration before early deletion charges stop applying in the Cool tier?
- 30 days
- 90 days
- 180 days
- 7 days
What is the minimum storage duration for the Archive tier?
- 180 days
- 30 days
- 90 days
- 365 days
Before a user can read a blob in the Archive tier, what must happen?
- It must be rehydrated to an online tier
- Soft delete must be enabled on the container
- A SAS token must be generated for it
- A snapshot must be taken of it
With standard priority, how long can rehydrating a blob from Archive take?
- Up to 15 hours
- Up to 15 minutes
- About one hour
- Up to 7 days