50 Free Azure Administrator Practice Questions (AZ-104)

Answer: b) Authorizing access to Azure resources based on assigned roles

Explanation: Azure RBAC (Role-Based Access Control) manages who has access to Azure resources, what they can do with them, and what areas they have access to.

Answer: a) Azure AD (Entra ID)

Explanation: Azure Active Directory (now Microsoft Entra ID) provides identity services including authentication, SSO, and access management for Azure resources and applications.

Answer: b) A container for managing access, policies, and compliance across multiple subscriptions

Explanation: Management groups provide hierarchical organization for subscriptions, enabling governance at scale with inherited policies and RBAC assignments.

Answer: b) Deny

Explanation: The Deny effect blocks resource creation or modification that violates the policy. Audit creates a warning but allows the action. Append adds additional fields.

Answer: a) Resource locks prevent deletion/modification; policies enforce compliance rules

Explanation: Resource locks (CanNotDelete, ReadOnly) prevent accidental deletion/modification. Azure Policy enforces organizational standards and compliance rules.

Answer: d) Resource

Explanation: RBAC permissions are additive and inherited downward. The most specific scope (resource) can override inherited permissions from higher scopes.

Answer: a) Defining a repeatable set of Azure resources that comply with standards

Explanation: Azure Blueprints package artifacts (policies, RBAC, ARM templates, resource groups) into a deployable blueprint for consistent environment creation.

Answer: a) SSPR (Self-Service Password Reset)

Explanation: SSPR allows users to reset their passwords without IT intervention. It requires Azure AD Premium licensing and proper configuration.

Answer: b) An identity for applications and automation tools to access Azure resources

Explanation: A service principal is an identity created for use with applications, hosted services, and automation tools to access Azure resources with specific permissions.

Answer: b) Password Hash Sync

Explanation: Password Hash Sync synchronizes password hashes from on-premises AD to Azure AD. Pass-through Authentication validates passwords against on-premises AD directly.

Answer: d) GZRS (Geo-Zone-Redundant Storage)

Explanation: GZRS synchronously replicates data across three AZs in the primary region, then asynchronously to a secondary region. It offers 16 nines of durability.

Answer: d) Archive

Explanation: Archive tier is the lowest cost (~$0.002/GB/month) but requires 12+ hours for data retrieval. Hot tier has highest cost but instant access.

Answer: b) Providing delegated access to storage resources with specific permissions and expiration

Explanation: SAS tokens provide time-limited, permission-restricted access to storage resources without sharing the account key. They can be service, account, or user delegation SAS.

Answer: b) AzCopy

Explanation: AzCopy is a command-line utility designed for high-performance upload, download, and copy of data to/from Azure Storage with resume capabilities.

Answer: b) 4.75 TB (4.75 TiB)

Explanation: The maximum size of a single blob in Azure Blob Storage is approximately 4.75 TB (or larger with premium block blob accounts).

Answer: a) Azure File Sync

Explanation: Azure File Sync caches frequently accessed files from Azure file shares on on-premises Windows Servers, enabling hybrid file server scenarios with cloud tiering.

Answer: b) Automating tier transitions and data expiration based on rules

Explanation: Lifecycle management rules automatically move blobs between access tiers (Hot → Cool → Archive) or expire old data to optimize storage costs.

Answer: b) Azure Container Instances (ACI)

Explanation: ACI provides serverless container execution — you define containers without managing underlying VMs. It's ideal for simple, fast container workloads.

Answer: b) Availability Sets

Explanation: Availability Sets distribute VMs across fault domains (different racks) and update domains (maintenance windows) within a datacenter. They protect against hardware failures and planned maintenance.

Answer: b) Automatically scaling a group of identical VMs based on demand

Explanation: VMSS creates and manages a group of identical, load-balanced VMs that can automatically scale in/out based on metrics or schedules.

Answer: d) Ultra Disk

Explanation: Ultra Disk provides the highest performance with sub-millisecond latency and configurable IOPS/throughput for I/O-intensive workloads.

Answer: a) Premium plan provides always-ready instances and VNet integration

Explanation: Premium plan eliminates cold starts with pre-warmed instances and supports VNet connectivity. Consumption plan scales from zero (cold starts possible) and has lower cost.

Answer: b) Azure Kubernetes Service (AKS)

Explanation: AKS provides a managed Kubernetes control plane with automated upgrades, scaling, and integration with Azure services (AD, networking, monitoring).

Answer: b) A live environment for staging and swapping deployments

Explanation: Deployment slots (like staging, production) allow zero-downtime deployments by swapping slots. Traffic can be redirected to validate changes before full deployment.

Answer: a) uniqueString()

Explanation: uniqueString() creates a deterministic hash string based on the provided parameters, useful for creating unique resource names.

Answer: b) Building and patching container images automatically

Explanation: ACR Tasks automate building and patching container images on code commit or base image update, enabling CI/CD pipelines for containers.

Answer: c) NC/NV-series (GPU)

Explanation: NC, ND, and NV series VMs include NVIDIA GPUs for compute-intensive workloads like AI training, rendering, and visualization.

Answer: b) ExpressRoute

Explanation: ExpressRoute provides dedicated private connections from on-premises to Azure, bypassing the public internet for higher reliability, lower latency, and higher security.

Answer: a) Filtering network traffic to/from Azure resources based on rules

Explanation: NSGs filter network traffic at the subnet or NIC level using inbound/outbound rules with source/destination IP, port, and protocol.

Answer: b) Application Gateway

Explanation: Application Gateway operates at Layer 7 with features like URL-based routing, SSL termination, session affinity, and WAF integration.

Answer: a) VNet peering connects VNets within Azure; VPN Gateway connects on-premises to Azure

Explanation: VNet peering connects two Azure VNets (same or different regions) using Microsoft's backbone. VPN Gateway connects on-premises networks to Azure over the internet.

Answer: b) A fully managed RDP/SSH access service without public IPs

Explanation: Azure Bastion provides secure RDP/SSH connectivity to VMs directly from the Azure Portal, eliminating the need for public IPs on VMs.

Answer: b) Azure Private DNS Zones

Explanation: Private DNS Zones manage DNS records within VNets, enabling custom domain resolution for internal resources without exposing them to the internet.

Answer: a) A managed, cloud-based firewall service with built-in high availability

Explanation: Azure Firewall is a managed firewall service with built-in high availability, auto-scaling, and features like threat intelligence, FQDN filtering, and DNS proxy.

Answer: b) Azure DDoS Protection

Explanation: Azure DDoS Protection mitigates DDoS attacks. Basic tier is automatically enabled, Standard tier provides advanced attack analytics and mitigation.

Answer: b) Providing private connectivity to Azure PaaS services from a VNet

Explanation: Private Link creates private endpoints for Azure PaaS services (SQL, Storage, etc.), allowing access over private IPs within a VNet instead of public endpoints.

Answer: c) Performance

Explanation: Performance routing directs traffic to the endpoint with the lowest latency for the user. Geographic routes based on user location.

Answer: b) A connection from a VNet to Azure PaaS services over the Microsoft backbone

Explanation: Service endpoints provide direct connectivity from VNets to Azure services (SQL, Storage, etc.) over the Azure backbone, bypassing the internet.

Answer: a) Azure Monitor

Explanation: Azure Monitor provides a single platform for collecting, analyzing, and acting on telemetry from Azure and on-premises environments.

Answer: b) Recovery Services vault

Explanation: The Recovery Services vault stores backup data and manages backup policies for Azure VMs, Azure Files, SQL Server, and SAP HANA.

Answer: b) Replicating workloads to a secondary region for disaster recovery

Explanation: Azure Site Recovery replicates Azure VMs and on-premises workloads to a secondary region, enabling orchestrated failover and failback for disaster recovery.

Answer: a) Cost

Explanation: Azure Advisor provides recommendations in five categories: Cost (right-sizing, reserved instances), Security (NSG rules, encryption), Reliability (backups, redundancy), Performance (scaling, slow queries), and Operational Excellence.

Answer: a) Storing log data for analysis and querying

Explanation: Log Analytics workspaces store log and metric data from Azure resources. KQL (Kusto Query Language) is used to query and analyze the data.

Answer: b) An alert triggered when a metric value crosses a defined threshold

Explanation: Metric alerts evaluate resource metrics (CPU, memory, requests) at regular intervals and trigger actions when conditions are met.

Answer: b) SMS

Explanation: Action groups define notification and action responses when alerts fire. Supported notifications include email, SMS, push notifications, voice calls, webhooks, and ITSM connections.

Answer: b) Defining which logs and metrics to collect and where to send them

Explanation: Diagnostic settings specify which platform logs and metrics to collect from Azure resources and where to send them (Log Analytics, Storage Account, Event Hub).

Answer: b) KQL (Kusto Query Language)

Explanation: KQL is the query language used in Log Analytics for searching, filtering, aggregating, and visualizing log data.

Answer: b) Assessing and deploying updates to Azure and on-premises VMs

Explanation: Update Management (in Azure Automation) assesses update compliance and schedules update deployments for Windows and Linux VMs across Azure and on-premises.

Answer: b) Azure Cost Management + Billing

Explanation: Azure Cost Management + Billing provides cost analysis, budget creation, alerts, and recommendations for optimizing Azure spending.

Answer: a) Organizing resources for cost allocation, management, and automation

Explanation: Azure Tags (key-value pairs) categorize resources by purpose, owner, environment, or cost center. They enable filtered cost reports, policy enforcement, and automation.