AZ-104: Microsoft Azure Administrator Practice Exam

A company onboards 50 users who all need identical Azure permissions. The IT team wants to avoid managing 50 individual role assignments. What is the most efficient RBAC approach?

1. Create a management group and assign the role at subscription level
2. Create a security group, add the users, and assign the RBAC role to the group
3. Assign the role to each user individually via PowerShell
4. Create a custom Azure Policy that assigns roles automatically

A team needs to grant support staff the ability to restart virtual machines in one resource group, but not to create or delete them. No built-in role matches exactly. What should the administrator do?

1. Assign the built-in Contributor role at the resource-group scope
2. Assign the built-in Virtual Machine Contributor role at the subscription scope
3. Create a custom RBAC role granting only the restart action and assign it at the resource-group scope
4. Assign the built-in Owner role and ask staff not to delete VMs

An organization needs to enforce naming conventions across subscriptions. Non-compliant resources should be flagged for review but not blocked from being created. Which governance configuration fits?

1. Azure Resource Manager mandatory tag policy requiring a naming-convention tag
2. Azure Policy with the Audit effect that flags non-compliant resources in the compliance dashboard
3. Azure Blueprints with a Delete lock preventing modification of non-conforming resources
4. Azure Policy with the Deny effect that blocks creation of non-compliant names

A firm must give a vendor temporary 90-day access to Azure resources that expires automatically, without relying on someone remembering to remove it. Which feature fits?

1. Privileged Identity Management (PIM) with time-bound eligible assignments that expire after 90 days
2. A separate Azure subscription for the vendor, decommissioned afterward
3. Permanent guest accounts in Entra ID with a calendar reminder to delete them
4. Sharing existing administrator credentials for the project duration

A startup runs a web app with unpredictable traffic spikes during launches. It wants automatic horizontal scaling while minimizing cost during quiet periods. Which compute option fits?

1. A Reserved VM Instance on a one-year commitment
2. Virtual Machine Scale Sets with metric-based autoscale rules on CPU utilization
3. Azure Container Instances with manual replica adjustments by the ops team
4. A single high-spec VM with vertical scaling

An e-commerce company needs to host a .NET app with automatic OS patching, built-in authentication, and deployment slots for staging swaps. Which Azure service fits?

1. Azure App Service, providing managed hosting with integrated authentication and slot support
2. Azure Virtual Machines with IIS and manual patch management
3. Azure Container Instances running the container image without orchestration
4. Azure Kubernetes Service with Helm chart deployments

A media company stores large videos accessed frequently in the first week but rarely after 30 days. It wants automatic cost optimization as access cools. Which Blob Storage feature fits?

1. Immutable storage with a legal hold protecting content from modification
2. Azure File Sync with cloud tiering to move cold files to on-premises storage
3. Blob versioning with automatic snapshots for multiple copies
4. Lifecycle management rules that transition blobs from Hot to Cool to Archive by age

A pharma company must store clinical data so that it cannot be modified or deleted — even by administrators — for 7 years. Which feature meets this compliance need?

1. Immutable blob storage with a locked time-based retention policy
2. Soft delete with a 7-year retention window
3. Azure Backup with a long-term geo-redundant retention vault
4. Annual access-key rotation

Two Azure VNets in different regions must communicate with low latency over the Microsoft backbone, without traffic traversing the public internet. Which feature fits?

1. ExpressRoute with a private peering circuit connecting on-premises to both regions
2. Traffic Manager with priority-based DNS routing between regions
3. A site-to-site VPN gateway with encrypted tunnels between the regions
4. Global virtual network peering connecting the VNets across regions over the Microsoft backbone

A school runs Azure VMs that must be reachable from the internet on TCP 443 only. All other inbound traffic, including RDP, must be blocked. Which configuration fits?

1. A public IP on each VM with no additional network security controls
2. A Network Security Group with an inbound allow rule for TCP 443 and default deny for everything else
3. Azure Firewall with a DNAT rule forwarding only port 443 to the VMs
4. An internal load balancer with a health probe on port 443