Provide Valid AZ-104 Dumps To Help You Prepare For Microsoft Azure Administrator Exam Nov 11, 2025
Microsoft AZ-104 Dumps Questions [2025] Pass for AZ-104 Exam
NEW QUESTION # 161
You need to configure the alerts for VM1 and VM2 to meet the technical requirements.
Which three actions should you perform in sequence? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
1 - Create an alert rule.
2 - Create an Azure SQL database.
3 - Create a Log Analytics workspace.
NEW QUESTION # 162
You have several Azure virtual machines on a virtual network named VNet1.
You configure an Azure Storage account as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 163
You need to implement Role1.
Which command should you run before you create Role1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell Get-AzRoleDefinition -Name "Reader" | ConvertTo-Json
https://docs.microsoft.com/en-us/powershell/module/az.resources/get-azroledefinition?view=azps-5.9.0
https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/convertto-json?view=powershell-7.1
https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0
Topic 3, Contoso Ltd
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
File servers
Domain controllers
Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App1. App1 is comprised of the following three tiers:
A SQL database
A web front end
A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
Move all the tiers of App1 to Azure.
Move the existing product blueprint files to Azure Blob storage.
Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
Move all the virtual machines for App1 to Azure.
Minimize the number of open ports between the App1 tiers.
Ensure that all the virtual machines for App1 are protected by backups.
Copy the blueprint files to Azure over the Internet.
Ensure that the blueprint files are stored in the archive storage tier.
Ensure that partner access to the blueprint files is secured and temporary.
Prevent user passwords or hashes of passwords from being stored in Azure.
Use unmanaged standard storage for the hard disks of the virtual machines.
Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
Designate a new user named Admin1 as the service administrator of the Azure subscription.
Admin1 must receive email alerts regarding service outages.
Ensure that a new user named User3 can create network objects for the Azure subscription.
NEW QUESTION # 164
You need to configure the Device settings to meet the technical requirements and the user requirements.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
Answer:
Explanation:
Explanation:
Box 1: Selected
Only selected users should be able to join devices
Box 2: Yes
Require Multi-Factor Auth to join devices.
From scenario:
Ensure that only users who are part of a group named Pilot can join devices to Azure AD Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
NEW QUESTION # 165
You have an Azure Active Directory (Azure AD) tenant named contoso.com that is synced to an Active Directory domain. The tenant contains the users shown in the following table.
The users have the attribute shown in the following table.
You need to ensure that you can enable Azure Multi-Factor Authentication (MFA) for all four users.
Solution: You add a mobile phone number for User2 and User4.
Does this meet the Goal?
- A. No
- B. Yes
Answer: A
Explanation:
Explanation
User3 requires a user account in Azure AD.
Note: Your Azure AD password is considered an authentication method. It is the one method that cannot be disabled.
References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-methods
NEW QUESTION # 166
You have an Azure subscription named Subscription1. Subscription1 contains the resources in the following table.
VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and Vnet2.
An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.
You need to move the custom application to Vnet2. The solution must minimize administrative effort.
Which two actions should you perform? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
We cannot just move a virtual machine between networks. What we need to do is identify the disk used by the VM, delete the VM itself while retaining the disk, and recreate the VM in the target virtual network and then attach the original disk to it.
First action: Delete VM1
Second action: Create a new virtual machine
Reference:
https://docs.microsoft.com/en-us/archive/blogs/canitpro/step-by-step-move-a-vm-to-a-different-vnet-on-azure
https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-azure-vmbetween-vnets
NEW QUESTION # 167
You are evaluating the name resolution for the virtual machines after the planned implementation of the Azure networking infrastructure.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Answer:
Explanation:
Statement 1: Yes
All client computers in the Paris office will be joined to an Azure AD domain.
A virtual network named Paris-VNet that will contain two subnets named Subnet1 and Subnet2.
Microsoft Windows Server Active Directory domains, can resolve DNS names between virtual networks.
Automatic registration of virtual machines from a virtual network that's linked to a private zone with auto-registration enabled. Forward DNS resolution is supported across virtual networks that are linked to the private zone.
Statement 2: Yes
A virtual network named ClientResources-VNet that will contain one subnet named ClientSubnet You plan to create a private DNS zone named humongousinsurance.local and set the registration network to the ClientResources-VNet virtual network.
As this is a registration network so this will work.
Statement 3: No
Only VMs in the registration network, here the ClientResources-VNet, will be able to register hostname records. Since Subnet4 not connected to Client Resources Network thus not able to register its hostname with humongoinsurance.local Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-overview
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-insta
Topic 3, Contoso Ltd
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
* File servers
* Domain controllers
* Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App1. App1 is comprised of the following three tiers:
* A SQL database
* A web front end
* A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
Move all the tiers of App1 to Azure.
Move the existing product blueprint files to Azure Blob storage.
Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
* Move all the virtual machines for App1 to Azure.
* Minimize the number of open ports between the App1 tiers.
* Ensure that all the virtual machines for App1 are protected by backups.
* Copy the blueprint files to Azure over the Internet.
* Ensure that the blueprint files are stored in the archive storage tier.
* Ensure that partner access to the blueprint files is secured and temporary.
* Prevent user passwords or hashes of passwords from being stored in Azure.
* Use unmanaged standard storage for the hard disks of the virtual machines.
* Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
* Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
* Designate a new user named Admin1 as the service administrator of the Azure subscription.
* Admin1 must receive email alerts regarding service outages.
* Ensure that a new user named User3 can create network objects for the Azure subscription.
NEW QUESTION # 168
You have an Azure subscription that contains the virtual networks shown in the following table.
The subscription contains the private DNS zones shown in the following table.
You add virtual network links to the private DNS zones as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation
Text Description automatically generated
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links
https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration
NEW QUESTION # 169
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1.
You to create a lifecycle management rule for storage' that will automatically move the blobs in container' to the lowest-cost tier after 90 days.
How should you complete the rule? TO answer, select the appropriate options in the answer are
a.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 170
You plan to move a distributed on-premises app named App1 to an Azure subscription.
After the planned move, App1 will be hosted on nine Azure virtual machines.
You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance.
What should you create?
- A. one Availability Set that has three fault domains and one update domain
- B. one virtual machine scale set that has 10 virtual machines instances
- C. one virtual machine scale set that has 12 virtual machines instances
- D. one Availability Set that has 10 update domains and one fault domain
Answer: B
Explanation:
Azure will automatically distribute 10 VMs into five update zones evenly. So during planned maintenance of one update zone only two VMs will be affected.
Note: How do availability sets work?
The underlying Azure platform assigns an update domain and a fault domain to each virtual machine in your availability set. Each availability set can have up to 3 fault domains and 20 update domains. You can't change these configurations after you create the availability set.
Reference:
https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-overview
NEW QUESTION # 171
You plan to create the Azure web apps shown in the following table.
What is the minimum number of App Service plans you should create for the web apps?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Since Python on Windows is no longer supported, we have to use Linux platform.
ASP.NET is only supported on Windows platform. So we need at least 2 App Service plan.
NEW QUESTION # 172
You have an Azure subscription named Subscription1.
In Subscription1, you create an Azure web app named WebApp1. WebApp1 will access an external service that requires certificate authentication.
You plan to require the use of HTTPS to access WebApp1.
You need to upload certificates to WebApp1.
In which formats should you upload the certificate? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
A PFX file contains the public key file (SSL Certificate) and its unique private key file. This is required for HTTPS access. The web app will distribute the public key (in a CER file) to clients that connect to the web app.
The CER file is an SSL Certificate which has the public key of the external service. The external service will have the private key associated with the public key contained in the CER file.
NEW QUESTION # 173
You have an Azure subscription that contains a resource group named Test RG.
You use TestRG to validate an Azure deployment.
TestRG contains the following resources:
You need to delete TestRG.
What should you do first?
- A. Turn off VM1 and delete all data in Vault1.
- B. Remove the resource lock from VNET1 and delete all data in Vault1.
- C. Modify the backup configurations of VM1 and modify the resource lock type of VNET1.
- D. Turn off VM1 and remove the resource lock from VNET1.
Answer: D
Explanation:
Explanation
When you want to delete the resource, you first need to remove the lock.
References:
https://docs.microsoft.com/sv-se/azure/azure-resource-manager/management/lock-resources
NEW QUESTION # 174
You have the App Service plans shown in the following table.
You plan to create the Azure web apps shown in the following table.
You need to identify which App Service plans can be used for the web apps.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=platform-linux
https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage#
NEW QUESTION # 175
HOTSPOT
You have the App Service plan shown in the following exhibit.
The scale-in settings for the App Service plan are configured as shown in the following exhibit.
The scale out rule is configured with the same duration and cool down tile as the scale in rule.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer:
Explanation:
Section: [none]
Explanation:
Box 1: 5
The maximum 5 will kept as the CPU Usage >= 30.
Box 2: 3
As soon as the average CPU usage drops below 30%, the count will decrease by 1. After the 5 minute cool- down it will decrease by another 1, reaching 3.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-autoscale-performance-schedule
NEW QUESTION # 176
You have the Azure virtual networks shown in the following table.
To which virtual networks can you establish a peering connection from VNet1?
- A. VNet2 and VNet3 only
- B. VNet2 only
- C. VNet3 and VNet4 only
- D. VNet2, VNet3, and VNet4
Answer: C
Explanation:
References:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal
You can connect virtual networks to each other with virtual network peering.
These virtual networks can be in the same region or different regions (also known as Global VNet peering).
Once virtual networks are peered, resources in both virtual networks are able to communicate with each other, with the same latency and bandwidth as if the resources were in the same virtual network.
Global VNet Peering is now generally available in all Azure public regions, excluding the China, Germany, and Azure Government regions.
The address space is the most critical configuration for a VNet in Azure.
This is the IP range for the entire network that will be divided into subnets.
The address space can almost be any IP range that you wish (public or private).
You can add multiple address spaces to a VNet.
To ensure this VNet can be connected to other networks, the address space should never overlap with any other networks in your environment. If a VNet has an address space that overlaps with another Azure VNet or on-premises network, the networks cannot be connected, as the routing of traffic will not work properly.
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal
https://azure.microsoft.com/en-in/updates/general-availability-global-vnet-peering/#:~:text=Global%20VNet%20Peering%20is%20now,transit%20over%20the%20public%20internet.
https://www.microsoftpressstore.com/articles/article.aspx?p=2873369
NEW QUESTION # 177
Hotspot Question
You have an Azure subscription and a Microsoft Entra ID P1 license.
You need to perform the following actions:
- Enable self-service password reset (SSPR) for all users.
- Require the users to answer four questions when registering for SSPR.
Which two settings should you use? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Properties
Enable self-service password reset (SSPR) for all users.
Enable self-service password reset
Microsoft Entra ID lets you enable SSPR for None, Selected, or All users.
Box 2: Authentication methods
Require the users to answer four questions when registering for SSPR.
Select authentication methods and registration options
When users need to unlock their account or reset their password, they're prompted for another confirmation method. This extra authentication factor makes sure that Microsoft Entra ID finished only approved SSPR events. You can choose which authentication methods to allow, based on the registration information the user provides.
Reference:
https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr
NEW QUESTION # 178
You need to prepare the environment to ensure that the web administrators can deploy the web apps as quickly as possible.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation
Step 1:
First you create a storage account using the Azure portal.
Step 2:
Select Automation options at the bottom of the screen. The portal shows the template on the Template tab.
Deploy: Deploy the Azure storage account to Azure.
Step 3:
Share the template.
Scenario: Web administrators will deploy Azure web apps for the marketing department. Each web app will be added to a separate resource group. The initial configuration of the web apps will be identical. The web administrators have permission to deploy web apps to resource groups.
References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-quickstart-create-templates-us
NEW QUESTION # 179
You have an Azure Kubernetes Service (AKS) cluster named AKS1.
You need to configure cluster autoscaler for AKS1.
Which two tools should you use? Each correct answer presents a complete solution,
NOTE: Each correct selection is worth one point
- A. the set-AzAKs cmdlet
- B. the Azure portal
- C. the set Azvm cmdlet
- D. the kubect1 command
- E. The az aks command
Answer: B,D
NEW QUESTION # 180
You have an Azure subscription named Subscription1 that has the following providers registered:
* Authorization
* Automation
* Resources
* Compute
* KeyVault
* Network
* Storage
* Billing
* Web
Subscription1 contains an Azure virtual machine named VM1 that has the following con figurations:
* Private IP address: 10.0.0.4 (dynamic)
* Network security group (NSG): NSG1
* Public IP address: None
* Availability set: AVSet
* Subnet: 10.0.0.0/24
* Managed disks: No
* Location: East US
You need to record all the successful and failed connection attempts to VM1.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Create an Azure Storage account
- B. Add an Azure Network Watcher connection monitor
- C. Register the Microsoft.LogAnalytics provider
- D. Register the Microsoft.Insights resource provider
- E. Enable Azure Network Watcher in the East US Azure region
- F. Enable Azure Network Watcher flow logs
Answer: A,C,E
Explanation:
References:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal
NEW QUESTION # 181
You need to configure the Device settings to meet the technical requirements and the user requirements.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
Answer:
Explanation:
NEW QUESTION # 182
You have an Azure subscription that contains the Azure virtual machines shown in the following table.
You configure the network interfaces of the virtual machines to use the settings shown in the following table
From the settings of VNET1, you configure the DNS servers shown in the following exhibit.
The virtual machines can successfully connect to the DNS server that has an IP address of 192.168.10.15 and the DNS server that has an IP address of 193.77.134.10.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Answer:
Explanation:
NEW QUESTION # 183
You have an Azure subscription that contains the resources shown in the following table.
You need to create a network interface named NIC1.
In which location can you create NIC1?
- A. East US and North Europe only.
- B. East US and West Europe only.
- C. East US, West Europe, and North Europe.
- D. East US only.
Answer: D
Explanation:
Before creating a network interface, you must have an existing virtual network in the same location and subscription you create a network interface in.
If you try to create a NIC on a location that does not have any Vnets you will get the following error: "The currently selected subscription and location lack any existing virtual networks. Create a virtual network first." Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface
NEW QUESTION # 184
You have an Azure Storage account named storage1 that contains a blob container named container1.
You need to prevent new content added to container1 from being modified for one year.
What should you configure?
- A. the access tier
- B. an access policy
- C. the Access control (IAM) settings
- D. the access level
Answer: B
Explanation:
Time-based retention policies: With a time-based retention policy, users can set policies to store data for a specified interval. When a time-based retention policy is set, objects can be created and read, but not modified or deleted. After the retention period has expired, objects can be deleted but not overwritten.
https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview?tabs=azure- portal
https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-time-based-retention-policy- overview
NEW QUESTION # 185
......
Microsoft AZ-104 certification exam is an essential credential for professionals who want to demonstrate their skills and knowledge in managing Azure environments. Microsoft Azure Administrator certification covers a range of topics, including Azure security, governance, identity, and access management, as well as Azure cost management and optimization. Microsoft Azure Administrator certification is highly respected by employers and is a valuable asset for professionals looking to advance their careers in cloud computing.
The Microsoft AZ-104 exam consists of multiple-choice questions, and the candidate will have two hours to complete it. The cost of the exam is $165 USD, and it can be taken online or in-person at a testing center. Microsoft recommends that candidates have experience with Azure services, PowerShell, and the Command Line Interface (CLI) before taking the exam.
Achieve Success in Actual AZ-104 Exam AZ-104 Exam Dumps: https://braindumpsschool.vce4plus.com/Microsoft/AZ-104-valid-vce-dumps.html