AZ104 Microsoft Azure Administrator Free Practice Test — 30 Questions

Question 1

A global financial services firm\'s critical trading application has gone offline due to a security breach that compromised the primary database server, a virtual machine in Azure. The firm operates across multiple continents and cannot tolerate extended downtime, as this directly impacts revenue and regulatory compliance. The compromise of the VM hosting the database necessitates a rapid and robust recovery strategy that ensures data integrity and minimizes service interruption. The IT operations team needs to quickly bring the application back online in a secure and compliant manner.

Which Azure recovery strategy would most effectively address the immediate need to restore application functionality and ensure business continuity in this scenario?

Accepted Answer

Initiate a failover of the affected virtual machine and its associated data to a secondary Azure region using Azure Site Recovery.

Question 2

A critical distributed application deployed on Azure Kubernetes Service (AKS) is experiencing sporadic failures in inter-microservice communication, leading to intermittent degradation of user-facing features. The application logs indicate that certain service requests are timing out, but there are no obvious resource constraints on the nodes or pods. The infrastructure team suspects a network-related issue, possibly due to evolving security requirements or changes in cluster configuration. Which diagnostic approach would most effectively pinpoint the root cause of these intermittent communication failures within the AKS cluster?

Accepted Answer

Utilize `kubectl exec` to run network diagnostic tools (e.g., `ping`, `curl`, `nc`) from within the affected microservice pods to test connectivity to dependent services, and concurrently review Kubernetes Network Policies and CoreDNS status.

Question 3

A multinational corporation, \"AstroDynamics,\" is migrating its critical research data to Azure Blob Storage. Due to strict regulatory compliance and data sovereignty mandates within their operating regions, AstroDynamics requires that all access to this sensitive data be restricted to authorized internal personnel and that data transmission must remain within the Azure backbone network, never traversing the public internet. Which combination of Azure services would be most effective in enforcing these requirements?

Accepted Answer

Azure Policy to enforce network access configurations and Azure Private Link for private connectivity

Question 4

An Azure administrator is responsible for a mission-critical web application hosted on Azure Virtual Machines. The application experiences significant, unpredictable spikes in user traffic throughout the day, necessitating high availability and responsiveness during peak periods. However, during off-peak hours, the workload is considerably lighter, and maintaining a large number of active virtual machines incurs substantial unnecessary costs. The administrator needs to implement a solution that automatically adjusts the number of running virtual machine instances to match the fluctuating demand, thereby optimizing both performance and expenditure. Which Azure service or feature is most appropriate for this scenario?

Accepted Answer

Configure auto-scaling rules on Azure Virtual Machine Scale Sets (VMSS) based on performance metrics.

Question 5

A cloud architect is tasked with designing a secure and scalable ingress solution for an Azure Kubernetes Service (AKS) cluster hosting a critical e-commerce platform. The solution must provide robust protection against common web-based attacks, offer advanced HTTP/S load balancing capabilities, and ensure that all incoming traffic is inspected at the application layer before reaching the cluster\'s pods. The architect also needs to minimize the attack surface by consolidating the entry point for external requests. Which Azure service, when properly configured, best meets these requirements for securing and managing HTTP/S ingress to the AKS cluster?

Accepted Answer

Azure Application Gateway with Web Application Firewall (WAF) enabled

Question 6

A multinational corporation, \"Innovatech Solutions,\" is migrating its critical customer-facing web application to Azure. This application runs on a set of Azure Virtual Machines and is subject to stringent regulatory compliance, mandating minimal data loss and continuous operation even in the event of a regional outage. The business requires a Recovery Point Objective (RPO) of less than 5 minutes and a Recovery Time Objective (RTO) of under 1 hour for this application. The organization has selected a primary Azure region and needs to establish a robust disaster recovery strategy that ensures operational continuity and data integrity in a geographically distinct secondary Azure region. Which Azure service is most suitable for orchestrating the replication, failover, and recovery of these Azure Virtual Machines to meet these demanding business continuity and compliance objectives?

Accepted Answer

Azure Site Recovery

Question 7

A global e-commerce platform hosted on Azure experiences intermittent and unpredictable connectivity disruptions affecting users across multiple continents. The IT operations team has confirmed that the core application components are functioning as expected, but network latency and packet loss are significantly impacting user experience. The administrator is tasked with identifying the root cause, implementing a rapid resolution, and keeping all relevant stakeholders informed throughout the process. Which of the following sequences of actions best reflects a proactive and effective approach to resolving this complex Azure infrastructure issue?

Accepted Answer

Immediately investigate Azure Service Health for any platform-wide incidents impacting the affected regions, simultaneously analyze Azure Monitor logs and Network Watcher flow logs for the specific resources involved to identify network anomalies, and establish a communication channel with key stakeholders to provide regular updates on the diagnostic progress and mitigation efforts.

Question 8

A global administrator for a large enterprise is tasked with rectifying inconsistent User Principal Names (UPNs) for several synchronized user accounts. These accounts originate from an on-premises Active Directory environment that is synchronized with Microsoft Entra ID using Microsoft Entra Connect. The goal is to ensure that the UPNs in Microsoft Entra ID accurately reflect the intended organizational domain, facilitating improved user experience and access control. Which of the following actions is the most appropriate and recommended method to achieve this UPN consistency for synchronized users?

Accepted Answer

Modify the UPN directly within the Microsoft Entra admin center for each affected user account.

Question 9

A cloud engineering team responsible for deploying a critical web application to Azure App Service has encountered recurring issues with feature rollouts. Builds are sometimes corrupted or fail to initialize correctly post-deployment, leading to unscheduled downtime and increased manual intervention. The team\'s current process involves manually copying build outputs to the App Service, with minimal automated checks. They need to establish a robust, automated deployment strategy that guarantees the integrity of deployed artifacts and includes a mechanism for immediate validation of the application\'s health after each deployment.

Accepted Answer

Implement Azure DevOps Release Pipelines with automated deployment stages that incorporate post-deployment validation tests.

Question 10

Anya, an Azure administrator for a multinational corporation, is investigating persistent reports of degraded performance and intermittent connectivity for users accessing core business applications hosted in Azure. These users are primarily located in the Asia-Pacific region, while the applications reside in Azure Virtual Networks deployed in the West US region. Anya\'s goal is to significantly reduce network latency and ensure a stable, high-throughput connection for these users to the critical services. She needs to implement a solution that provides a unified global network transit and optimizes traffic flow across geographically dispersed Azure resources and potentially on-premises sites.

Which Azure networking solution should Anya prioritize to address these global connectivity and performance challenges?

Accepted Answer

Deploy Azure Virtual WAN with hubs strategically placed in key geographical regions to facilitate optimized global transit routing.

Question 11

An Azure Administrator is tasked with troubleshooting an inaccessible Windows virtual machine in Azure. Upon investigation, it\'s discovered that a recently applied Network Security Group (NSG) rule has inadvertently blocked all inbound Remote Desktop Protocol (RDP) traffic on TCP port 3389. The virtual machine is running a critical business application, and the administrator needs to restore RDP connectivity as quickly as possible without impacting the application\'s current operational state or requiring a full machine reboot. The administrator has the necessary permissions to modify NSG configurations.

Which of the following actions is the most appropriate and efficient first step to regain RDP access to the virtual machine?

Accepted Answer

Create a new inbound security rule in the relevant Network Security Group to allow RDP traffic (TCP port 3389) from a trusted administrative IP address to the virtual machine's private IP address.

Question 12

A cloud administrator is tasked with securing access for a critical Azure virtual machine that periodically retrieves sensitive configuration secrets from an Azure Key Vault. The virtual machine has a system-assigned managed identity enabled. To adhere to the principle of least privilege and ensure that the virtual machine\'s identity can only perform the necessary operations, which Azure role should be assigned to the managed identity, and at what scope should this assignment be made?

Accepted Answer

Assign the "Key Vault Reader" role to the system-assigned managed identity at the scope of the Azure Key Vault.

Question 13

A global enterprise has deployed a critical customer-facing application on Azure, spanning multiple virtual machines across different availability zones within a primary region. The business continuity plan mandates that in the event of a complete regional outage, the application must remain accessible to users worldwide with minimal interruption. The solution must prioritize automated failover and maintain a consistent user experience by directing traffic to a replicated deployment in a secondary Azure region. Which Azure networking service is most suitable for orchestrating this cross-region traffic redirection and ensuring application resilience?

Accepted Answer

Azure Traffic Manager

Question 14

A cloud administrator is tasked with ensuring all Azure Storage Accounts across the organization adhere to a strict encryption-at-rest policy, mandated by recent industry compliance regulations. They assign an Azure Policy to enforce this, configured with a remediation task to automatically enable encryption on any non-compliant storage accounts. Shortly after, due to a strategic shift in cloud governance, the administrator deletes this specific policy assignment. What is the most likely immediate consequence for the remediation task and its associated managed identity?

Accepted Answer

The remediation task and its associated managed identity are automatically removed.

Question 15

A global financial services firm is migrating critical trading applications to Azure while maintaining a hybrid connectivity model with their on-premises data centers. They are experiencing intermittent packet loss and latency spikes on their existing Azure VPN Gateway connection, impacting application responsiveness and compliance requirements for near real-time data synchronization. The firm requires a highly available and performant network path between their on-premises infrastructure and Azure, with automatic failover capabilities in case of a link failure. What is the most effective Azure networking solution to meet these stringent requirements for resilient hybrid connectivity?

Accepted Answer

Implement a dual Azure ExpressRoute circuit configuration, with each circuit provisioned through separate Microsoft peering locations and utilizing BGP for route advertisement and failover.

Question 16

A multinational logistics firm relies heavily on an Azure virtual machine to manage its global shipping manifests. During peak operational hours, the application hosted on this VM becomes unresponsive, leading to a complete halt in critical business processes. The IT operations team has been alerted, but initial attempts to diagnose the issue through basic connectivity checks and instance restarts have yielded no resolution. The team suspects an underlying operational anomaly within the VM\'s environment, but lacks a centralized repository for detailed operational data to pinpoint the exact cause of the failure and the sequence of events preceding it. What Azure service is most critical for the immediate, in-depth analysis of the VM\'s internal state and application behavior to facilitate rapid root cause identification and service restoration?

Accepted Answer

Azure Monitor Logs

Question 17

A cloud administrator is responsible for a mission-critical web application hosted on Azure App Service. This application experiences significant, unpredictable surges in user traffic throughout the day, often requiring more compute resources than initially provisioned. During periods of low activity, the application\'s resource consumption drops considerably. The administrator\'s primary objectives are to maintain application responsiveness and availability during peak loads while simultaneously optimizing operational expenditure during quieter periods. Which scaling strategy should be prioritized to effectively address these dual requirements for this dynamic workload?

Accepted Answer

Configure auto-scaling rules based on key performance metrics to dynamically adjust the number of App Service instances.

Question 18

A multinational corporation\'s core customer-facing application, hosted on Azure Virtual Machines and reliant on Azure SQL Database, is experiencing sporadic and unpredictable connectivity failures. These failures are impacting user experience and causing significant business disruption. The IT operations team has been unable to pinpoint a definitive cause through standard logging and monitoring tools. Given the urgency to stabilize the service and the need to understand the root cause of these intermittent network disruptions, which Azure diagnostic capability should be prioritized for immediate investigation to facilitate rapid problem resolution?

Accepted Answer

Utilize Azure Network Watcher's Connection Troubleshoot feature to analyze network paths and identify potential points of failure between application VMs and the database.

Question 19

A newly deployed web application, hosted on an Azure Virtual Machine in a custom virtual network, is intermittently failing to connect to a critical third-party API endpoint located outside Azure. Initial connectivity tests from the VM\'s console to the API\'s IP address on its required port (TCP 443) are inconsistent. The application\'s logs indicate intermittent network timeouts. To efficiently diagnose the root cause of these intermittent failures and ensure the application can reliably communicate with the external API, what is the most effective immediate action an Azure administrator should take to gain insight into the network traffic flow between the VM and the API?

Accepted Answer

Configure Azure Network Watcher's NSG flow logs for the Network Security Group associated with the VM's network interface, directing the logs to a Log Analytics workspace, and then query the logs to identify any denied outbound traffic to the API's IP address and port.

Question 20

A project team is expanding, and a new Azure administrator, Kaelen, needs to be onboarded to manage virtual machines and their associated network configurations within a designated resource group named \'app-prod-rg\'. Existing team members have been granted specific roles at various scopes to adhere to security best practices. Kaelen requires the ability to start, stop, redeploy, and monitor virtual machines, as well as configure their network interfaces and associated public IP addresses within this specific resource group. Which of the following approaches best balances administrative efficiency with the principle of least privilege for Kaelen\'s access?

Accepted Answer

Assign the "Virtual Machine Contributor" role to Kaelen at the 'app-prod-rg' resource group scope.

Question 21

A company is deploying a customer-facing web application on Azure, which experiences unpredictable but significant spikes in user traffic. The application is critical for business operations and must maintain consistent responsiveness during these peak loads. Simultaneously, the IT department is under pressure to optimize cloud spending and avoid unnecessary costs associated with over-provisioning resources during periods of low activity. What configuration within Azure Virtual Machine Scale Sets (VMSS) would best address these competing requirements for performance and cost efficiency?

Accepted Answer

Configure VMSS auto-scaling rules to scale out based on a responsive CPU utilization threshold with a short cooldown period, and configure scale-in rules based on a lower CPU utilization threshold with a slightly longer cooldown period.

Question 22

A development team is deploying a new customer-facing web service on Azure, utilizing multiple Azure Virtual Machines within a single virtual network to ensure high availability. The service experiences unpredictable, spiky traffic patterns. The team requires a solution that can effectively distribute incoming network requests across these virtual machines and automatically remove any VM that becomes unresponsive from the traffic flow, without needing to manage application-level routing rules or global content delivery. Which Azure networking service is most suitable for this specific requirement?

Accepted Answer

Azure Load Balancer

Question 23

A multinational corporation\'s critical customer-facing portal, hosted on Azure, has begun exhibiting sporadic and severe performance degradation, including periods of unresponsiveness. The architecture includes Azure Load Balancer distributing traffic to multiple instances of an Azure App Service, which in turn interacts with an Azure SQL Database. Users report that the issues are not constant, making it difficult to replicate consistently. The IT operations team has confirmed that underlying Azure infrastructure health is nominal, and there are no widespread service outages reported. They suspect the problem is within the application\'s interaction with its dependencies or its internal processing under specific, yet unidentified, load conditions.

Which Azure diagnostic tool or service would be the most effective initial step for the administrator to identify the root cause of these intermittent performance issues?

Accepted Answer

Azure Application Insights

Question 24

A cloud administrator is tasked with re-architecting a critical, highly available customer-facing web application deployed on Azure Virtual Machines. The application experiences significant, unpredictable traffic surges throughout the day, leading to high operational costs due to over-provisioning during low-traffic periods. The existing deployment utilizes an Availability Set for redundancy. The administrator needs to implement a solution that dynamically adjusts the number of compute instances based on real-time demand, maintains robust availability, and optimizes expenditure without requiring a complete containerization strategy at this stage.

Which combination of Azure services would most effectively address these requirements?

Accepted Answer

Azure Virtual Machine Scale Sets with Premium SSD Managed Disks and Azure Load Balancer

Question 25

A development team reports that they can no longer establish SSH connections to their Linux virtual machines deployed in a specific Azure subnet. They have confirmed that the virtual machines are running and accessible within the Azure portal. The team suspects a network configuration issue. What is the most effective initial step to diagnose and potentially resolve this connectivity problem, considering the established Azure Bastion host is the designated access method?

Accepted Answer

Review the Network Security Group (NSG) rules associated with the virtual machine's subnet to ensure inbound traffic on TCP port 22 is permitted from the Azure Bastion host's service IP range.

Question 26

A multinational corporation is experiencing significant performance degradation and increased latency for its end-users accessing critical business applications hosted in Azure. These applications are deployed across multiple Azure regions to ensure high availability and disaster recovery. During peak usage periods, users report slow response times and occasional timeouts, regardless of their geographical location relative to the Azure regions. The IT operations team has confirmed that the underlying virtual machines and application services are healthy, and the issue appears to be related to how traffic is being routed and managed across the global network and between application tiers. The company needs a solution that can provide intelligent traffic management, optimize application delivery by leveraging Microsoft\'s global network, and enhance user experience by reducing latency.

Which Azure service should be implemented to address these challenges?

Accepted Answer

Azure Front Door

Question 27

A cloud engineering team is tasked with migrating a legacy application to Azure. This application utilizes an Azure AD service principal to automate the deployment and management of its associated resources, including virtual machines and Azure SQL databases. The team needs to create a new, dedicated service principal for this migrated application. To comply with the principle of least privilege and minimize the attack surface, what is the most appropriate approach for assigning permissions to this new service principal at the resource group level where the application\'s resources will reside?

Accepted Answer

Create a custom Azure RBAC role that grants only the necessary read permissions for configuration data and write permissions for resource deployment and management within the specific resource group.

Question 28

A cloud administrator is tasked with enforcing strict virtual machine sizing within a critical production environment hosted in Azure. A subscription-wide Azure Policy has been assigned to enforce the use of only `Standard_D2s_v3` and `Standard_D4s_v3` virtual machine sizes across the entire subscription. Subsequently, a more granular policy is implemented directly on the `rg-prod-web-01` resource group, mandating that all virtual machines deployed within this specific resource group must exclusively use `Standard_D2s_v3` or `Standard_D4s_v3` sizes. If an engineer attempts to deploy a virtual machine with the size `Standard_D8s_v3` into the `rg-prod-web-01` resource group, what will be the outcome?

Accepted Answer

The deployment will be blocked by the Azure Policy assigned to the `rg-prod-web-01` resource group.

Question 29

Anya, an Azure Administrator for a financial services company, is tasked with enhancing the resilience of a set of critical virtual machines hosting a trading platform. The primary concern is to ensure that if the underlying physical host hardware for any of these virtual machines fails unexpectedly, the affected virtual machines are automatically restarted and remain accessible to users. Anya needs a solution that provides fault isolation at the hardware level without requiring manual intervention during an outage.

Accepted Answer

Configure the virtual machines within an Availability Set.

Question 30

A global organization operates a hybrid environment, synchronizing its on-premises Active Directory Domain Services (AD DS) with Azure Active Directory (Azure AD) using Azure AD Connect. The security team mandates that all users accessing cloud applications must be protected by multi-factor authentication (MFA), but with a critical nuance: MFA should only be enforced for users accessing applications from outside the corporate network or when Azure AD Identity Protection detects a sign-in risk level of medium or higher. The administrator must configure Azure AD to meet these specific security requirements while minimizing disruption for users operating within the trusted corporate network and exhibiting low sign-in risk.

Which Azure AD feature and configuration best satisfies these dual requirements for conditional access?

Accepted Answer

Implement a Conditional Access policy that targets all cloud applications and users, specifying "Locations" as a condition to exclude trusted corporate IP addresses and "Sign-in risk" as a condition to include "Medium" and "High," with the grant control requiring multi-factor authentication.

AZ104 Microsoft Azure Administrator Free Practice Test — 30 Questions

A lot more is already mapped out

About the AZ104 Microsoft Azure Administrator Certification