Free AZ-104 Practice Exam Questions 2026 (With Explanations) — Azure Administrator Associate

Q: [OVERVIEW]Alpine Ski House runs an API worker pool across 18 Azure Virtual Machines inside a private subnet (`snet-workers`, `10.20.4.0/24`) in `vnet-prod-weu`.[/OVERVIEW] [ENVIRONMENT]• Security Posture: Compliance prohibits assigning individual public IP addresses to backend worker NICs, and zero unsolicited inbound internet connections may ever reach `snet-workers`. • Telemetry Alert: During peak package/update bursts, workers log `System.Net.Sockets.SocketException: SNAT port exhaustion` err

B. Azure NAT Gateway — Azure NAT Gateway provides secure, fully managed outbound-only internet connectivity for subnets with dynamic SNAT port allocation, completely preventing inbound scans and SNAT exhaustion.

Q: [OVERVIEW]Tailspin Toys hosts tier-1 SQL Server virtual machines in the Azure `East US` primary region, backed up nightly to an Azure Recovery Services Vault paired with `West US`.[/OVERVIEW] [ENVIRONMENT]• Vault Name: `rsv-prod-eastus` (Storage Replication Type: Geo-Redundant Storage / GRS). • Incident Status: `East US` is experiencing a multi-hour fiber cut and severe weather degradation; Microsoft has NOT yet formally declared a complete regional outage and initiated Microsoft-managed failove

D. Recovery Services Vault with Geo-Redundant Storage (GRS) and Cross-Region Restore (CRR) enabled — Cross-Region Restore (CRR) on a geo-redundant Recovery Services vault allows you to conduct restore drills and recover Azure VMs, disks, and SQL/SAP HANA databases in the secondary paired region at any time, even when the primary region is fully operational or impaired.

Q: [SCENARIO]You enforce role-based access control on resource group `rg-compute-prod`. Your compliance goal is to evaluate whether `User1` can permanently delete Azure Virtual Machines inside `rg-compute-prod`.[/SCENARIO] [SOLUTION]An administrator assigns `User1` TWO role assignments on `rg-compute-prod`: 1. Custom Role `VM-Safe-Operator`: `Actions = ["Microsoft.Compute/virtualMachines/*"]`, `NotActions = ["Microsoft.Compute/virtualMachines/delete"]` 2. Built-in Role `Contributor` on the same `rg

D. Yes, because NotActions is not an explicit deny; the Contributor role grants delete permission, which satisfies the request — In Azure RBAC, permissions are additive. NotActions is simply a subtraction from the Actions list in that specific role definition, NOT a deny assignment. Because Contributor grants the delete action, the user has permission to delete the VM.

Q: [SCENARIO]Three production Virtual Networks (`VNet1`, `VNet2`, `VNet3`) reside in the same Azure subscription. Workloads in `VNet1` (10.1.0.0/16) need direct IP connectivity to application servers located in `VNet3` (10.3.0.0/16).[/SCENARIO] [SOLUTION]You configure standard VNet Peering between `VNet1 VNet2` and a second VNet Peering between `VNet2 VNet3`. No Network Virtual Appliance (NVA), Azure Firewall, or custom User-Defined Routes (UDRs) are deployed inside `VNet2`.[/SOLUTION] [QUE

A. No, because Virtual Network Peering is non-transitive by default; traffic does not hop across VNet2 without a Network Virtual Appliance (NVA) — Azure VNet Peering is non-transitive. A spoke cannot reach another spoke through a hub simply via peering unless a router or Network Virtual Appliance (NVA) with route tables (UDR) is deployed in the hub.

Q: You have a multi-tier application in an Azure VNet consisting of Web VMs and Database VMs in the same subnet. You want to restrict traffic so that Database VMs only accept inbound traffic on TCP port 1433 originating from Web VMs. Which TWO components should you configure to achieve this with minimal administrative overhead? (Choose two.)

A. Create an NSG inbound rule with Source: asg-Web, Destination: asg-DB, Protocol: TCP, Destination Port: 1433, Action: Allow. & B. Create two Application Security Groups (ASGs): asg-Web and asg-DB, and attach the respective VM network interfaces to them. — CORRECT: Options B and C. - Application Security Groups (ASGs) allow grouping virtual machine NICs logically by application tier without managing individual IPs. - The NSG rule references the ASGs directly as source and destination. INCORRECT DISTRACTORS: - Option A creates severe administrative management overhead as VMs scale. - Options D and E are impossible or bad security practices.

Q: You are configuring Azure Backup for critical Windows and Linux IaaS virtual machines in a Recovery Services vault. You need to protect backup data against accidental deletion or ransomware attacks while ensuring immediate operational restores are available. Which TWO features should you enable? (Choose two.)

C. Soft delete for Recovery Services vaults (retaining deleted backup data for 14 additional days). & D. Instant Restore snapshot retention in the backup policy (retaining local snapshots for 1 to 5 days). — CORRECT: Options A and E. - Soft delete preserves deleted backup items for 14 days to prevent ransomware destruction. - Instant Restore retains local disk snapshots allowing near-instantaneous recovery without transferring data from the vault. INCORRECT DISTRACTORS: - Options B, C, and D degrade security and recovery capabilities.

Q: You need to enable identity-based SMB authentication for an Azure file share so that hybrid domain-joined Windows 11 clients can access files using existing Active Directory Domain Services (AD DS) credentials. Which TWO steps are required? (Choose two.)

B. Join the Azure Storage account to the on-premises AD DS domain using a computer account or service logon account. & E. Assign Azure share-level permissions (e.g. Storage File Data SMB Share Contributor) to Entra ID user groups synchronized from AD DS. — CORRECT: Options B and D. - The storage account must be registered with on-premises AD DS. - Users must have Azure RBAC share-level roles assigned to mount the share, after which standard Windows NTFS ACLs govern file/folder permissions. INCORRECT DISTRACTORS: - Option A is unsupported. - Option C exposes SMB to attack. - Option E breaks granular file permissions.

Q: You deploy an Azure Private DNS Zone named "corp.contoso.internal". You have two virtual networks: VNet-App and VNet-DB. You need VMs in VNet-App to resolve names of VMs in VNet-DB, and you want VMs deployed in VNet-DB to register their DNS host records automatically. Which TWO configurations must you make on the Private DNS Zone? (Choose two.)

A. Add a virtual network link for VNet-App to the private DNS zone. & C. Add a virtual network link for VNet-DB with "Enable auto registration" checked. — CORRECT: Options A and C. - A virtual network link with auto-registration enabled registers VM A-records in VNet-DB automatically. - A virtual network link for VNet-App allows VMs in that network to resolve names in the private zone. INCORRECT DISTRACTORS: - Option B exposes private topology publicly. - Options D and E are unnecessary and invalid.

Q: You are setting up an alert rule in Azure Monitor to notify the on-call engineer when an Azure SQL Database CPU usage exceeds 90%. You create an Action Group. Which TWO notification and action types can be configured directly inside an Azure Monitor Action Group? (Choose two.)

B. Email / SMS message / Push notification / Voice call. & D. Webhook / Azure Function / Logic App automation trigger. — CORRECT: Options B and E. - Azure Monitor Action Groups support direct human notifications (Email, SMS, Push, Voice) and automated runbook actions (Webhook, Logic App, Azure Functions, Automation Runbook). INCORRECT DISTRACTORS: - Options A, C, and D are fictional distractors.

Q: You need to enable secure administrative management (RDP and SSH) to Azure virtual machines in a virtual network without assigning public IP addresses to the VMs and without establishing a site-to-site VPN. You decide to deploy Azure Bastion. What TWO requirements must be met before deploying Azure Bastion? (Choose two.)

A. A standard SKU public IP address must be created and allocated to the Azure Bastion host. & D. A dedicated subnet named exactly "AzureBastionSubnet" with a prefix of at least /26 must exist in the virtual network. — CORRECT: Options A and D. - Azure Bastion requires a dedicated subnet named exactly AzureBastionSubnet with at least /26 subnet mask. - Bastion requires a dedicated Standard SKU Public IP address for inbound browser TLS 443 connectivity. INCORRECT DISTRACTORS: - Option B negates the purpose of Bastion (VMs do not need public IPs). - Options C and E are false.

Q1 / 10 CASE STUDY Moderate

Configure and Manage Virtual Networking

[OVERVIEW]Alpine Ski House runs an API worker pool across 18 Azure Virtual Machines inside a private subnet (`snet-workers`, `10.20.4.0/24`) in `vnet-prod-weu`.[/OVERVIEW] [ENVIRONMENT]• Security Posture: Compliance prohibits assigning individual public IP addresses to backend worker NICs, and zero unsolicited inbound internet connections may ever reach `snet-workers`. • Telemetry Alert: During peak package/update bursts, workers log `System.Net.Sockets.SocketException: SNAT port exhaustion` errors against outbound HTTPS endpoints.[/ENVIRONMENT] [REQUIREMENTS]Provide resilient, scalable outbound-only internet connectivity for `snet-workers` with dynamic SNAT port allocation while strictly prohibiting unsolicited inbound traffic.[/REQUIREMENTS] [QUESTION]Which managed Azure networking service must you associate with `snet-workers`?[/QUESTION]

Q2 / 10 CASE STUDY Expert

Monitor and Maintain Azure Resources

[OVERVIEW]Tailspin Toys hosts tier-1 SQL Server virtual machines in the Azure `East US` primary region, backed up nightly to an Azure Recovery Services Vault paired with `West US`.[/OVERVIEW] [ENVIRONMENT]• Vault Name: `rsv-prod-eastus` (Storage Replication Type: Geo-Redundant Storage / GRS). • Incident Status: `East US` is experiencing a multi-hour fiber cut and severe weather degradation; Microsoft has NOT yet formally declared a complete regional outage and initiated Microsoft-managed failover. • Recovery SLA: RPO < 24 hours; RTO < 2 hours for isolated VM verification in `West US`.[/ENVIRONMENT] [REQUIREMENTS]Database engineers must spin up and restore the backed-up virtual machines directly inside the secondary paired region (`West US`) right now without waiting for Microsoft to trigger an official regional disaster declaration.[/REQUIREMENTS] [QUESTION]Which Recovery Services Vault configuration enables immediate self-service restore into the secondary paired region before an official Microsoft declaration?[/QUESTION]

Q3 / 10 YES NO Expert

Manage Azure Identities and Governance

[SCENARIO]You enforce role-based access control on resource group `rg-compute-prod`. Your compliance goal is to evaluate whether `User1` can permanently delete Azure Virtual Machines inside `rg-compute-prod`.[/SCENARIO] [SOLUTION]An administrator assigns `User1` TWO role assignments on `rg-compute-prod`: 1. Custom Role `VM-Safe-Operator`: `Actions = ["Microsoft.Compute/virtualMachines/*"]`, `NotActions = ["Microsoft.Compute/virtualMachines/delete"]` 2. Built-in Role `Contributor` on the same `rg-compute-prod` scope.[/SOLUTION] [QUESTION]Can User1 delete virtual machines in `rg-compute-prod`, and why?[/QUESTION]

Q4 / 10 YES NO Moderate

Configure and Manage Virtual Networking