Scroll down to see your responses and detailed results
Free Microsoft Azure Administrator Associate AZ-104 Practice Test
Prepare for the Microsoft Azure Administrator Associate AZ-104 exam with this free practice test. Randomly generated and customizable, this test allows you to choose the number of questions.
- Questions: 15
- Time: 15 minutes (60 seconds per question)
- Included Objectives:Manage Azure identities and governanceImplement and manage storageDeploy and manage Azure compute resourcesConfigure and manage virtual networkingMonitor and maintain Azure resources
An IT administrator needs to assign Microsoft 365 licenses to all users in the Sales department. The administrator wants to ensure that as users join or leave the department, the license assignments are updated automatically without manual effort. What is the BEST way to achieve this?
Assign licenses to a static security group containing the Sales department users.
Use Privileged Identity Management (PIM) to assign licenses to users.
Create a dynamic group based on the department attribute and assign licenses to that group.
Manually assign licenses to each user in the Sales department.
Answer Description
Creating a dynamic group that automatically includes users based on their department attribute and assigning licenses to that group automates the license assignment process. This ensures that when users join or leave the Sales department, the licenses are assigned or removed automatically. Manually assigning licenses is inefficient and doesn't scale well. Assigning licenses to a static group would require manual updates to group membership. Using Privileged Identity Management is unrelated to license assignments; it's used for managing and controlling privileged access.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a dynamic group in Azure Active Directory?
How do Azure AD groups differ from traditional Active Directory groups?
What is the significance of the department attribute in Azure AD?
You manage virtual machines (VMs) in Azure that reside within a private virtual network and are not accessible from the internet. Administrators need to connect to these VMs remotely for maintenance purposes. You need to provide secure, seamless remote connectivity to these VMs without exposing them to the internet or requiring a virtual private network connection.
What should you implement?
Deploy an Azure Bastion host in the virtual network
Implement Azure Firewall to permit remote management traffic
Set up a site-to-site connection for administrators to access the VMs
Assign public addresses to the VMs and restrict access using Network Security Groups (NSGs)
Answer Description
You should deploy an Azure Bastion host in the virtual network. Azure Bastion provides secure remote connectivity to all VMs within the virtual network over SSL using the Azure portal. It allows administrators to access the VMs through the Azure portal without exposing the VMs to the public internet or requiring a VPN connection. This ensures that your VMs remain private while still allowing necessary remote management.
Option A is incorrect because setting up a site-to-site connection involves configuring VPN connections, which adds complexity and requires additional infrastructure. Option C is not recommended because assigning public addresses to the VMs exposes them to the internet, increasing security risks, even if Network Security Groups (NSGs) are used to restrict access. Option D is incorrect because Azure Firewall is designed for filtering and controlling network traffic, but it does not facilitate remote connectivity solutions for managing VMs.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is Azure Bastion and how does it work?
What are the advantages of using Azure Bastion over a traditional VPN?
What are Network Security Groups (NSGs) and how do they relate to Azure Bastion?
Your company is deploying a new cloud-based application that requires licenses for a large number of employees. You want to ensure that when users join or leave the company, the license management process is efficient and requires minimal administrative effort. What should you configure to achieve this?
Assign licenses to individual users manually.
Enable self-service licensing for users.
Use administrative units for license distribution.
Utilize group-based licensing.
Answer Description
Utilizing group-based licensing is the most efficient method for managing licenses at scale in Azure AD. When you assign licenses to a group, all members of that group automatically receive the licenses, and they are removed when users leave the group. This streamlines the process of onboarding and offboarding employees without the need for manual intervention each time. Assigning licenses to individual users manually is not practical for a large number of employees and increases administrative overhead. Administrative units are used to delegate administrative permissions and scope management tasks but do not facilitate automatic license assignment. Enabling self-service licensing allows users to request licenses themselves; however, this approach may not align with organizational policies requiring control over license distribution and does not automate license revocation when users leave.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is group-based licensing in Azure AD?
How do I create a group for group-based licensing in Azure AD?
What are the advantages of using group-based licensing over manual license assignment?
Users report they cannot access the web application hosted on your Azure virtual machine from the internet, even though it was working previously. The virtual machine is running, and the web server is operational. What should you check first to resolve the connectivity issue?
Verify if a Network Security Group is blocking inbound traffic to the application.
Verify that the Azure Load Balancer is configured correctly.
Ensure that the application has an outbound internet connection.
Check if the private IP address of the server has changed due to a restart.
Answer Description
You should verify if a Network Security Group (NSG) associated with the network interface or subnet is blocking inbound traffic on the required ports. NSGs act as virtual firewalls, and if rules deny inbound traffic to the web server ports, external access will fail. Checking the NSG rules helps identify if any recent changes caused the connectivity issue. The other options are less likely to be the immediate cause: a change in the private IP address does not impact access via the public IP address; an outbound internet connection is not necessary for inbound access; and unless a Load Balancer is in use, its configuration would not affect single virtual machine connectivity.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a Network Security Group (NSG)?
How do I check if the NSG is blocking traffic?
What are the common ports to check for web applications?
As an Azure administrator, you receive a report that a user named Alex cannot assign roles to other users in the 'Operations' subscription. You verify that Alex has been assigned the 'User Access Administrator' role at the resource group level for the 'Networking' resource group.
Which of the following explains why Alex cannot assign roles in the 'Operations' subscription?
The 'Operations' subscription has a deny assignment preventing role assignments.
Alex needs the 'Owner' role to assign roles at the subscription level.
The 'User Access Administrator' role does not grant permissions to assign roles.
Alex does not have the required role assignment scope to assign roles at the subscription level.
Answer Description
Alex cannot assign roles at the 'Operations' subscription level because his 'User Access Administrator' role assignment is scoped to the 'Networking' resource group. Role assignments are only effective within their assigned scope and any child resources. Since Alex's role is assigned at the resource group level, he can only assign roles within the 'Networking' resource group, not at the subscription level. To assign roles at the subscription level, he would need the 'User Access Administrator' role assigned at the subscription scope.
Option A is incorrect because the 'User Access Administrator' role does grant permissions to assign roles. Option C is incorrect because, while the 'Owner' role includes permissions to assign roles, Alex can also assign roles with the 'User Access Administrator' role if assigned at the correct scope. Option D is incorrect because there's no indication of a deny assignment; the issue is due to the scope of Alex's role assignment.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is role assignment scope in Azure?
What does the 'User Access Administrator' role specifically do?
Why is the Owner role different from User Access Administrator?
An organization needs to delegate administrative permissions so that certain administrators can manage users and groups within their own department without affecting other departments. Which Azure feature should you implement to achieve this?
Azure Entra ID Administrative Units
Azure Entra ID Privileged Identity Management
Azure Role-Based Access Control (RBAC)
Azure Management Groups
Answer Description
Administrative Units in Azure Entra ID allow you to delegate administrative permissions to specific subsets of users or groups within your organization, such as by department or region. By using Administrative Units, you can assign administrators to manage only the users and groups within a particular Administrative Unit, without giving them broader access to other resources in Azure Entra ID. Other features like Azure Entra ID Privileged Identity Management, Management Groups, and Role-Based Access Control (RBAC) do not provide the necessary scope limitation at the department level within Azure AD user and group management.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are Azure Entra ID Administrative Units?
How do Administrative Units differ from Role-Based Access Control (RBAC)?
What are some best practices for using Administrative Units in Azure AD?
An organization with multiple departments wants to delegate password reset permissions to department-specific administrators so they can manage user passwords only within their own department. How can this be accomplished in Azure Entra ID?
Assign roles to administrators scoped to users in each department using Administrative Units
Apply Conditional Access Policies to restrict password reset operations
Use Azure AD Privileged Identity Management to assign roles
Create security groups for each department and assign administrators to manage those groups
Answer Description
Administrative units in Azure Entra ID allow you to delegate administrative permissions to specific subsets of users. By creating administrative units for each department and assigning roles scoped to those units, you can ensure that administrators have permissions only over users in their department. Azure AD Privileged Identity Management helps manage privileged roles but does not scope permissions to specific subsets of users. Conditional Access Policies control access conditions but do not delegate administrative permissions. Security groups are useful for grouping users but do not restrict administrative scope for role assignments.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are Administrative Units in Azure Entra ID?
How do you create and manage Administrative Units in Azure Entra ID?
What are the benefits of delegating password reset permissions using Administrative Units?
An organization needs to have full control over the encryption keys used to protect their data stored in an Azure Storage account. They decide to use their own keys instead of the default keys provided by Azure. Which action should the administrator perform to meet this requirement?
Enable server-side encryption with Microsoft-managed keys
Configure the storage account to use customer-managed keys stored in Azure Key Vault
Implement client-side encryption using Azure Storage SDK
Enable Azure Disk Encryption on the storage account
Answer Description
To have full control over the encryption keys for data at rest in Azure Storage, the administrator should configure the storage account to use customer-managed keys stored in Azure Key Vault. This approach allows the organization to manage key creation, rotation, and revocation, providing greater control over access to their data. Enabling Azure Disk Encryption is applicable to virtual machine disks, not storage accounts. Implementing client-side encryption requires additional application code and management overhead, and it does not leverage Azure's server-side encryption capabilities. Enabling server-side encryption with Microsoft-managed keys uses the default keys managed by Azure, which does not satisfy the requirement for the organization to use their own keys.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are customer-managed keys and how do they work in Azure?
What is Azure Key Vault and how does it enhance security?
What are the differences between client-side and server-side encryption in Azure?
Which Azure resource defines the hardware configuration (such as CPU, memory, and storage capacity) of a virtual machine during creation?
Virtual network
Virtual machine image
Resource group
Virtual machine size
Answer Description
The virtual machine size determines the hardware specifications of the VM, including the number of CPUs, memory, and storage capacity. When creating a VM, selecting the appropriate size ensures it meets the performance requirements.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What factors should I consider when choosing a virtual machine size in Azure?
What is the difference between a virtual machine size and a virtual machine image?
How do I find the right virtual machine size for my application in Azure?
Which Azure feature allows you to grant temporary access to storage resources without sharing your storage account key?
Secure Transfer Required
Shared Access Signature
Network Security Groups
Azure Active Directory Authentication
Answer Description
Shared Access Signatures (SAS) enable you to grant limited-time access to your storage resources without exposing your storage account key. SAS tokens can be configured with specific permissions and timeframes. Azure Active Directory (Azure AD) authentication provides identity-based access control but does not create temporary access tokens for storage. Secure Transfer Required enforces the use of HTTPS for data transfers but does not manage access. Network Security Groups control network traffic but do not grant access to storage resources.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are the different types of Shared Access Signatures (SAS)?
How do I create a Shared Access Signature (SAS) in Azure?
What are the security implications of using Shared Access Signatures (SAS)?
You need to create an Azure App Service plan to host a web application that requires custom domains and SSL certificates for secure traffic. The application must automatically scale to handle varying traffic loads. Cost optimization is important. Which App Service plan tier should you choose to best meet these requirements?
Shared
Basic
Standard
Premium
Answer Description
The Standard tier supports custom domains, SSL certificates, and automatic scaling, making it suitable for applications that need to handle variable traffic securely. It provides the necessary features at a cost-effective price point. The Basic tier supports custom domains and SSL certificates but does not support automatic scaling. The Premium tier includes all required features but at a higher cost, which is unnecessary given the need to optimize costs. The Shared tier does not support SSL certificates, making it unsuitable for securing traffic.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are the benefits of using an Azure App Service plan?
What is the process for setting up custom domains on Azure App Service?
What factors should be considered when choosing an App Service plan tier?
You are configuring backups for Azure resources located in the East US region. You need to create a vault to store these backups. Which location should you select for the vault to ensure optimal performance and compatibility?
Any region
A different region
The default region set for the subscription
The same region as the resources being backed up
Answer Description
When creating a backup vault for Azure resources, it's important to place the vault in the same region as the resources being backed up. This minimizes latency and ensures seamless integration between the backup service and the resources. Selecting a different region, the default subscription region, or any region without considering the resource location can lead to increased latency and potential issues with backup and restore operations.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
Why is it important to place the backup vault in the same region as the resources?
What could happen if I choose a different region for the backup vault?
What is Azure Backup, and how does it relate to the backup vault location?
Which of the following can be used to perform file-level recovery from an Azure virtual machine backup?
Use the Instant Restore feature of Azure Backup
Use Azure Site Recovery's Failover option
Use the Azure VM's Snapshot feature
Use Azure Backup's File Recovery feature
Answer Description
Azure Backup's File Recovery feature allows administrators to browse and recover individual files and folders from an Azure VM backup without restoring the entire VM. This is useful when only specific files need to be restored. The other options either do not support file-level recovery or are used for different purposes, such as whole VM snapshots or disaster recovery.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is Azure Backup's File Recovery feature?
Why can't I use the Azure VM's Snapshot feature for file-level recovery?
What is the difference between Azure Backup and Azure Site Recovery?
Guest users added to an Azure Entra ID tenant have the same default permissions as regular members.
False
True
Answer Description
This statement is false. In Azure Entra ID, guest users do not have the same default permissions as regular members. By default, guest users have restricted access and limited permissions to directory resources. They can access only the resources explicitly shared with them. Regular members, on the other hand, have broader access within the directory. Understanding this difference is important for administrators to manage access and maintain security.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are the default permissions for guest users in Azure Entra ID?
How can administrators manage and customize guest user permissions in Azure Entra ID?
What is the difference between regular members and guest users in Azure Entra ID?
Deploying Azure Bastion requires installing client software on the administrator's computer.
True
False
Answer Description
This statement is false. Azure Bastion allows administrators to securely access virtual machines through the Azure portal using a web browser without the need to install any additional client software. It provides RDP and SSH connectivity directly from the portal over SSL/TLS.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is Azure Bastion?
How does Azure Bastion provide secure access?
Why is using Azure Bastion preferable to traditional RDP or SSH?
Neat!
Looks like that's it! You can go back and review your answers or click the button below to grade your test.