How to Ace the AZ-104: Azure Administrator Associate

Question 1 · Manage Azure identities and governance

You need to ensure that users can reset their own passwords without administrator intervention. Which feature should you configure?

• Azure AD Conditional Access
• Self-Service Password Reset (SSPR)
• Azure AD Privileged Identity Management
• Azure AD Identity Protection

Correct answer: Self-Service Password Reset (SSPR)

Self-Service Password Reset (SSPR) allows users to reset their passwords without contacting IT. Users register authentication methods (phone, email, security questions) and can use them to verify identity and reset passwords.

Question 2 · Implement and manage storage

You have data that is accessed frequently for the first 30 days, then rarely accessed after that. Which storage solution is most cost-effective?

• Store everything in Hot tier
• Use lifecycle management to transition from Hot to Cool after 30 days
• Store everything in Archive tier
• Use Premium storage for all data

Correct answer: Use lifecycle management to transition from Hot to Cool after 30 days

Lifecycle management policies automatically transition blobs between tiers based on age. Data starts in Hot tier (low access cost), then moves to Cool after 30 days (lower storage cost, higher access cost). Optimizes costs based on access patterns.

Question 3 · Deploy and manage Azure compute resources

You need to deploy 20 identical virtual machines that can automatically scale based on CPU usage. Which feature should you use?

• Availability Sets
• Virtual Machine Scale Sets (VMSS)
• Availability Zones
• Proximity Placement Groups

Correct answer: Virtual Machine Scale Sets (VMSS)

Virtual Machine Scale Sets allow deploying and managing a set of identical VMs. Supports auto-scaling based on metrics like CPU, manual scaling, and integration with Azure Load Balancer.

Question 4 · Implement and manage virtual networking

You need to create a private network in Azure where resources can communicate securely. What is the fundamental building block?

• Network Security Group
• Virtual Network (VNet)
• Application Gateway
• Load Balancer

Correct answer: Virtual Network (VNet)

Azure Virtual Network (VNet) is the fundamental building block for private networks. Provides isolation and segmentation. Scoped to a single region; multiple VNets can be connected via peering.

Question 5 · Monitor and maintain Azure resources

You need to collect and analyze logs from multiple Azure resources in a central location. Which component of Azure Monitor should you use?

• Metrics
• Log Analytics Workspace
• Application Insights
• Service Health

Correct answer: Log Analytics Workspace

Log Analytics Workspace collects and stores log data from various sources. Query using Kusto Query Language (KQL). Can aggregate logs from multiple subscriptions and resource types.

Question 6 · Manage Azure identities and governance

Your company has acquired another company. You need to allow external users from the acquired company to access your applications using their existing credentials. What should you configure?

• Azure AD B2C
• Azure AD B2B
• Azure AD Domain Services
• Azure AD Connect

Correct answer: Azure AD B2B

Azure AD B2B (Business to Business) allows secure sharing of applications with external users who sign in with their own credentials. No additional licenses required for up to 5 guests per employee license.

Question 7 · Manage Azure identities and governance

You need to create a group that automatically includes all users in the Sales department. What type of group membership should you use?

• Assigned
• Dynamic User
• Dynamic Device
• Security Group with manual assignment

Correct answer: Dynamic User

Dynamic User membership automatically adds/removes users based on attribute rules. You can create a rule like 'department eq Sales' to automatically include all sales users. Requires Azure AD P1 or P2.

Question 8 · Manage Azure identities and governance

You need to grant a user permission to manage all resources in a resource group but not grant access to other resource groups. What should you do?

• Assign the Owner role at the subscription level
• Assign the Contributor role at the resource group level
• Assign the User Access Administrator role at the subscription level
• Assign the Reader role at the resource group level

Correct answer: Assign the Contributor role at the resource group level

The Contributor role at the resource group level allows managing all resources in that specific resource group without granting access to other resource groups or the ability to assign roles to others.

Question 9 · Manage Azure identities and governance

You need to prevent users from creating virtual machines in any region except East US and West Europe. Which Azure feature should you use?

• Azure RBAC
• Azure Policy
• Azure Blueprints
• Resource Locks

Correct answer: Azure Policy

Azure Policy enforces organizational standards and assesses compliance. The 'Allowed locations' built-in policy can restrict VM creation to specific regions. RBAC controls who can create resources, not where they can create them.

Question 10 · Manage Azure identities and governance

You have an application that needs to access Azure Storage without using credentials in code. Which identity type should you use?

• Service Principal with client secret
• Managed Identity
• Azure AD User account
• Shared Access Signature

Correct answer: Managed Identity

Managed Identities provide Azure services with an automatically managed identity in Azure AD. No credentials in code - Azure handles authentication. Can be system-assigned (tied to resource) or user-assigned (shared).