AZ-104: Microsoft Azure Administrator

AZ-104 exam objectives and study guide

The skills measured on the AZ-104 exam, by objective domain. Percentages are the share of the exam each domain carries.

AZ-104 practice questions and answers

11 free sample questions from the AZ-104 bank, with the correct answer and a full explanation for each. These are original questions written to the Microsoft objective domains — not real exam content.

1. Question 1Deploy and manage Azure compute resources

   A new subscription must host regulated workloads next week. In the Azure portal, the required host-encryption option does not appear when an administrator creates a VM that uses a supported size in an approved region. You need to make the option available for deployments in this subscription. Which command sequence should you run first?

   • ARun `az feature register --name EncryptionAtHost --namespace Microsoft.Compute`, and wait until `az feature show` reports `Registered`.
   • BRun `az provider register --namespace Microsoft.Storage`, and wait until the Storage provider reports `Registered`.
   • CRun `az feature register --name UltraSSD --namespace Microsoft.Compute`, and create the VM with Ultra Disk support enabled.
   • DRun the `az vm encryption enable` command for each VM after provisioning by using a Key Vault key.

   Show answer and explanation

   Correct answer

   • Run `az feature register --name EncryptionAtHost --namespace Microsoft.Compute`, and wait until `az feature show` reports `Registered`.

   Explanation

   The subscription must have the EncryptionAtHost feature registered in the Microsoft.Compute namespace before the setting can be used.

   • The correct sequence uses az feature register --name EncryptionAtHost --namespace Microsoft.Compute and then verifies that az feature show reports the feature state as Registered.
   • Registering the Microsoft.Storage provider does not register a Microsoft.Compute feature used by Azure VMs.
   • Registering the UltraSSD feature enables a different Compute capability for Ultra Disks and does not expose the VM host-based encryption setting.
   • az vm encryption enable configures Azure Disk Encryption for a VM after provisioning; it does not register the subscription feature and is not the same control.

   References:

   • Enable end-to-end encryption using encryption at host
   • az feature
   • Server-side encryption of Azure managed disks
2. Question 2Deploy and manage Azure compute resources

   A short-lived lab VM must shut down automatically each evening to reduce compute charges. While creating the VM in the Azure portal, on which tab can you enable the auto-shutdown setting?

   • AManagement
   • BBasics
   • CDisks
   • DNetworking
   • ETags

   Show answer and explanation

   Correct answer

   • Management

   Explanation

   Correct answer: Management.

   When you create a VM in the Azure portal, the Management tab contains the Auto-shutdown section. You can enable auto-shutdown, choose the shutdown time, and select the time zone during VM creation.

   • Basics is used for core VM settings such as subscription, resource group, name, region, image, and size.
   • Disks is used for OS and data disk configuration.
   • Networking is used for virtual network, subnet, public IP, and network security settings.
   • Tags is used to assign metadata and is not where auto-shutdown is configured.

   References:

   • Quickstart
   • Auto-shutdown a VM
3. Question 3Deploy and manage Azure compute resources

   In Cloud Shell, an administrator has a downloaded Azure Resource Manager JSON template for a small VM lab and needs to create the Bicep equivalent. Which command should the administrator run?

   • A`az bicep decompile --file ./azuredeploy.json`
   • B`az bicep build --file ./main.bicep`
   • C`az group export --name rg-vmlab > ./azuredeploy.json`
   • D`az deployment group create --resource-group rg-vmlab --template-file ./azuredeploy.json`

   Show answer and explanation

   Correct answer

   • `az bicep decompile --file ./azuredeploy.json`

   Explanation

   az bicep decompile --file is the Azure CLI command used to convert an ARM JSON template to Bicep.

   • `az bicep decompile --file ./azuredeploy.json` is correct.
   • `az bicep build --file ./main.bicep` converts Bicep to ARM JSON, which is the reverse direction.
   • `az group export --name rg-vmlab` exports a resource group's current resources as ARM JSON; it does not convert an existing JSON file to Bicep.
   • `az deployment group create` deploys a template; it does not perform conversion.

   References:

   • Decompile a JSON Azure Resource Manager template to Bicep
   • Bicep CLI commands
   • What is Bicep?
4. Question 4Implement and manage storage

   During an audit at Woodgrove Bank, security administrators want to require multifactor authentication when administrators configure identity-based access for Azure Files by using the Azure portal, Azure CLI, or Azure PowerShell. The policy must not be treated as a substitute for SMB authorization on the file shares. Which TWO statements should guide the design?

   • ATarget the Windows Azure Service Management API in Conditional Access to cover Azure portal, Azure CLI, and Azure PowerShell management operations.
   • BContinue to enforce SMB access by using Azure Files identity-based authentication, Storage File Data SMB roles, and Windows ACLs.
   • CTarget Microsoft Graph in Conditional Access because Microsoft Graph is the umbrella resource for Azure Resource Manager operations.
   • DTarget Microsoft Admin Portals as a bulk mechanism to include or exclude all backend Azure Storage management APIs.
   • EAssign Storage File Data SMB Share Elevated Contributor to administrators to require multifactor authentication for file share configuration.

   Show answer and explanation

   Correct answers

   • Target the Windows Azure Service Management API in Conditional Access to cover Azure portal, Azure CLI, and Azure PowerShell management operations.
   • Continue to enforce SMB access by using Azure Files identity-based authentication, Storage File Data SMB roles, and Windows ACLs.

   Explanation

   The correct statements are that a Conditional Access policy targeting the Windows Azure Service Management API can affect Azure management operations, and that SMB data access to Azure Files still depends on Azure Files identity-based authentication plus share-level and file-level authorization.

   • The Windows Azure Service Management API target covers Azure Resource Manager-related access, including Azure portal, Azure CLI, and Azure PowerShell management operations.
   • Conditional Access for management operations does not grant or replace Azure Files SMB permissions. Users still need a supported identity-based SMB configuration, Azure RBAC share-level permissions, and applicable Windows ACLs.
   • Microsoft Graph is not the Conditional Access target for Azure Resource Manager management operations.
   • Microsoft Admin Portals is not a bulk exclusion or inclusion for all backend services that admin portals call.
   • Storage File Data SMB Share Elevated Contributor is an authorization role for Azure Files SMB data access; it does not enforce MFA.

   References:

   • Targeting Resources in Conditional Access Policies
   • Microsoft Entra Conditional Access: Zero Trust Policy Engine
   • Overview
   • Assign Share-Level Permissions for Azure Files
5. Question 5Implement and manage virtual networking

   Mateo, a network administrator, must resolve an Azure Application Gateway WAF_v2 issue. The gateway routes HTTPS requests for two public host names to Azure App Service backends. Direct access to each app's azurewebsites.net host name succeeds, but Application Gateway Backend health reports an unhealthy HTTPS probe with a host name or certificate mismatch. The App Service apps will not be configured with additional custom certificates. Which configuration should Mateo change?

   • AConfigure the backend setting to override the host name by using the backend target host name, and use a probe that uses the backend setting host name.
   • BEnable cookie-based affinity on the backend setting so that repeat requests use the same App Service instance.
   • CPlace a Standard public Azure Load Balancer in front of the App Service apps and probe TCP 443.
   • DChange the custom probe match criteria to include HTTP status codes 200 through 499.

   Show answer and explanation

   Correct answer

   • Configure the backend setting to override the host name by using the backend target host name, and use a probe that uses the backend setting host name.

   Explanation

   For App Service backends that use the default *.azurewebsites.net certificate, Application Gateway must send a host name that matches the backend certificate and the App Service host binding. Configure the backend setting to override the host name, commonly by selecting Pick host name from backend target, and use a probe that uses that host name.

   • Cookie-based affinity affects client session persistence; it does not fix TLS host name validation or probe host headers.
   • Azure Load Balancer is a Layer 4 service and does not terminate HTTPS or validate backend certificates for this scenario.
   • Expanding the probe status-code match range does not correct a certificate common name or host header mismatch.
   • Enabling HTTP/2 on the listener changes the client-side protocol behavior and does not make the backend TLS certificate match the host name.

   References:

   • Health monitoring overview for Azure Application Gateway
   • Troubleshoot backend health issues in Azure Application Gateway
   • What is Azure Application Gateway
6. Question 6Implement and manage virtual networking

   A customer-facing web application is deployed in two Azure regions. The current design uses Azure Traffic Manager to direct users to each regional endpoint. During a regional outage test, many users continue to reach the failed region for several minutes because of DNS caching. The operations team needs faster failover for public HTTP/HTTPS traffic, with optional WAF and edge acceleration. Which load-balancing service should you recommend?

   • AAzure Front Door
   • BAzure Traffic Manager with performance routing
   • CAzure Application Gateway WAF_v2
   • DAzure Load Balancer with a global tier frontend

   Show answer and explanation

   Correct answer

   • Azure Front Door

   Explanation

   Azure Front Door is the appropriate service for global HTTP/HTTPS load balancing with edge acceleration, WAF options, and origin health probes. Unlike Traffic Manager, Front Door proxies application traffic at the edge instead of relying only on DNS responses, which helps provide faster failover for web applications.

   • Traffic Manager is DNS-based; DNS caching and clients that ignore TTL values can delay failover.
   • Application Gateway is a regional Layer 7 load balancer and cannot provide global routing across regions by itself.
   • Azure Load Balancer is a Layer 4 service for TCP/UDP traffic and does not provide HTTP WAF or edge acceleration.
   • Azure API Management can distribute API traffic, but it is an API gateway rather than the general global web load-balancing and acceleration service for this requirement.

   References:

   • Load Balancing Options
   • Load balancing and content delivery in Azure
   • Azure Front Door Overview
7. Question 7Implement and manage virtual networking

   A storage account that hosts application logs must accept traffic from two existing VM subnets and reject traffic from the internet. The solution must keep the standard storage account DNS name, avoid private DNS administration, and avoid maintaining public outbound IP address rules. Which two configuration changes are required?

   • AEnable the Microsoft.Storage service endpoint on each subnet that hosts the VMs.
   • BAdd each subnet as a virtual network rule on the storage account networking configuration.
   • CAdd outbound NSG rules that allow the Storage service tag to TCP port 443 from each subnet.
   • DCreate a private endpoint for the blob subresource and link a privatelink.blob.core.windows.net private DNS zone.
   • EEnable the storage account exception that allows trusted Microsoft services to access the account.

   Show answer and explanation

   Correct answers

   • Enable the Microsoft.Storage service endpoint on each subnet that hosts the VMs.
   • Add each subnet as a virtual network rule on the storage account networking configuration.

   Explanation

   The correct choices are to enable the Storage service endpoint on the client subnets and add matching virtual network rules to the storage account.

   • Enable the Microsoft.Storage service endpoint on each VM subnet: service endpoints are configured on subnets and extend the subnet identity to supported Azure PaaS services.
   • Add each subnet as a virtual network rule on the storage account: the storage firewall must explicitly allow the subnet; enabling the endpoint alone does not grant access.
   • An NSG rule that allows the Storage service tag only controls outbound traffic from the subnet. It does not configure the storage account firewall to trust the subnet.
   • A private endpoint with a privatelink.blob.core.windows.net zone is a valid Private Link design, but it violates the stated requirement to avoid private DNS administration and is not a service endpoint configuration.
   • The trusted Microsoft services exception is limited to specific Azure services and does not allow arbitrary VM subnet traffic to the storage account.

   References:

   • Azure virtual network service endpoints
   • Azure Storage firewall rules and network access
8. Question 8Implement and manage virtual networking

   Proseware runs an Azure SQL logical server for an order-processing application. Only VMs in one application subnet should connect to the database over the Azure backbone. The design must use virtual network service endpoints, not Private Link, and must not rely on client public IP allow lists. Which two actions should be included?

   • AEnable the Microsoft.Sql service endpoint on the application subnet.
   • BCreate a virtual network rule on the Azure SQL logical server for the application subnet.
   • CDisable public network access on the logical server after the subnet rule is created.
   • DAdd a server-level firewall rule that contains the private address range of the application subnet.
   • ECreate a private endpoint for the SQL server and configure privatelink.database.windows.net name resolution.

   Show answer and explanation

   Correct answers

   • Enable the Microsoft.Sql service endpoint on the application subnet.
   • Create a virtual network rule on the Azure SQL logical server for the application subnet.

   Explanation

   The correct choices are to configure the subnet for the SQL service endpoint and create a virtual network rule on the Azure SQL logical server.

   • Microsoft.Sql service endpoint on the subnet enables service endpoint routing and subnet identity for Azure SQL.
   • A virtual network rule on the logical server is the Azure SQL firewall object that allows traffic from that subnet.
   • Disabling public network access is a Private Link-oriented setting; virtual network service endpoint rules use the Azure SQL public endpoint with selected network access.
   • A server-level firewall rule that lists the subnet private CIDR is not the service endpoint model. Azure SQL virtual network rules reference virtual networks and subnets.
   • A private endpoint and privatelink.database.windows.net DNS configuration would be a valid Private Link pattern, but it does not meet the stated service endpoint requirement.

   References:

   • Virtual network endpoints and rules for databases
   • az sql server vnet-rule
   • Azure virtual network service endpoints
9. Question 9Implement and manage virtual networking

   Leila, a platform security engineer, must restrict an Azure Key Vault so that secrets can be retrieved only by workloads running in a specific VM subnet. The workloads already have the required data-plane permissions. The solution must use service endpoints and must not introduce private endpoints. Which two network configurations are required?

   • AEnable the Microsoft.KeyVault service endpoint on the VM subnet.
   • BAdd the VM subnet as an allowed virtual network in the Key Vault networking settings.
   • CAssign the Key Vault Secrets User role to the workload managed identity.
   • DEnable the Key Vault option that allows trusted Microsoft services to bypass the firewall.
   • ECreate a private endpoint for the vault and link a privatelink.vaultcore.azure.net private DNS zone.

   Show answer and explanation

   Correct answers

   • Enable the Microsoft.KeyVault service endpoint on the VM subnet.
   • Add the VM subnet as an allowed virtual network in the Key Vault networking settings.

   Explanation

   The correct choices are to enable the Key Vault service endpoint on the subnet and add the subnet to the Key Vault firewall.

   • Microsoft.KeyVault on the subnet enables the subnet to use a virtual network service endpoint for Key Vault.
   • A Key Vault virtual network rule is required so the Key Vault firewall allows requests from that subnet.
   • The Key Vault Secrets User role controls data-plane authorization. It does not satisfy a Key Vault firewall requirement, and the stem states permissions are already in place.
   • The trusted Microsoft services bypass is not a targeted allow rule for arbitrary VMs in your subnet.
   • A private endpoint and privatelink.vaultcore.azure.net private DNS zone would use Private Link, not service endpoints.

   References:

   • Configure network security for Azure Key Vault
   • Azure virtual network service endpoints
   • az keyvault network-rule
10. Question 10Monitor and maintain Azure resources

    Relecloud is standardizing its backup catalog and wants to identify workloads that Azure Backup can protect directly. Which two workload types are supported by Azure Backup?

    • AOn-premises files, folders, and system state by using the Microsoft Azure Recovery Services agent.
    • BEntire Windows and Linux Azure VMs by using Azure VM backup extensions.
    • CMicrosoft Entra Conditional Access policies by using a Recovery Services vault backup policy.
    • DAzure DNS private zones by using a Backup vault policy.
    • EAzure Load Balancer rules by using the Microsoft Azure Recovery Services agent.

    Show answer and explanation

    Correct answers

    • On-premises files, folders, and system state by using the Microsoft Azure Recovery Services agent.
    • Entire Windows and Linux Azure VMs by using Azure VM backup extensions.

    Explanation

    Azure Backup supports both selected on-premises workloads and Azure workloads.

    • The Microsoft Azure Recovery Services (MARS) agent can back up on-premises files, folders, and system state.
    • Azure Backup can protect entire Windows and Linux Azure VMs by using Azure VM backup extensions.

    The other options describe real Azure or Microsoft Entra resources, but not Azure Backup workloads in a Recovery Services or Backup vault. Microsoft Entra Conditional Access policy recovery is handled by Microsoft Entra Backup and Recovery, not Azure Backup. Azure DNS private zones and Azure Load Balancer configurations are not listed Azure Backup workload types.

    References:

    • What is Azure Backup?
    • Support matrix for the MARS agent
    • About Azure VM backup
11. Question 11Monitor and maintain Azure resources

    Aiko, an operations analyst, is documenting the built-in backup behavior for Azure Database for PostgreSQL flexible server. Which two statements are accurate?

    • AThe default backup retention period is seven days and can be configured up to 35 days.
    • BPoint-in-time restore is available within the configured backup retention period.
    • CGeo-redundant backup storage can be enabled after the server is provisioned.
    • DAutomatic backup files can be exported and used to create servers outside the flexible server instance.
    • EBackups are retained only while the flexible server is running.

    Show answer and explanation

    Correct answers

    • The default backup retention period is seven days and can be configured up to 35 days.
    • Point-in-time restore is available within the configured backup retention period.

    Explanation

    For Azure Database for PostgreSQL flexible server built-in backups:

    • The default backup retention period is 7 days, and it can be configured up to 35 days.
    • Point-in-time restore is available only within the configured backup retention period.

    Geo-redundant backup storage must be selected during server creation; it cannot be enabled later. Automatic backup files cannot be exported or used directly to create servers outside the flexible server instance. Backups are retained based on the retention period even for stopped servers.

    References:

    • Backup and Restore in Azure Database for PostgreSQL Flexible Server
    • About Azure Database for PostgreSQL Flexible server backup

Membership includes 216 questions and explanations aligned to the AZ-104 curriculum, including 11 case studies.

Other Microsoft certifications

Every one of these is included with the same membership as AZ-104.

AB-900Microsoft

Microsoft 365 Copilot and Agent Administration Fundamentals

This exam is intended for candidates who are familiar with Microsoft 365, including core services, security, identity and access, data…

161 practice questionsView

AI-900Microsoft

Microsoft Azure AI Fundamentals

This exam measures knowledge of machine learning and AI concepts and related Microsoft Azure services. It is intended for candidates…

193 practice questionsView

AZ-900Microsoft

Microsoft Azure Fundamentals

This exam is intended for technology professionals who want to demonstrate foundational knowledge of cloud concepts and Microsoft Azure.…

170 practice questionsView

AZ-104 exam FAQ