Microsoft AZ-104 Practice Exams
Last updated on Oct 02,2026- Exam Code: AZ-104
- Exam Name: Microsoft Azure Administrator
- Certification Provider: Microsoft
- Latest update: Oct 02,2026
You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named NSG1 is associated to Subnet1, NSG1 on default rules.
You need to create a rule in NSG1 to prevent the hosts on Subnet1 from connecting to the azure portal. The hosts must be able to connect to other …
To what should you set Destination in the rule?
- A . Service tag
- B . IP addresses
- C . Application security group
- D . Any
HOTSPOT
You plan to deploy the following Azure Resource Manager (ARM) template.
For each of the following statements, select Yes. Otherwise, select No. NOTE: Each correct selection is worth one point.
You have an Azure subscription.
The subscription contains a storage account named storage1 that has the lifecycle management rules shown in the following table.
On June 1, you store a blob named File1 in the Hot access tier of storage1.
What is the state of File1 on June 7?
- A . stored in the Archive access tier
- B . stored in the Hot access tier
- C . stored in the Cool access tier
- D . deleted
You have an Azure subscription that contains the virtual machines shown in the following table.
You deploy a load balancer that has the following configurations:
• Name: LB 1
• Type: Internal
• SKU: Standard
• Virtual network: VNET1
You need to ensure that you can add VM1 and VM2 to the backend pool of L81.
Solution: You create two Standard SKU public IP addresses and associate a Standard SKU public IP address to the network interface of each virtual machine.
Does this meet the goal?
- A . Yes
- B . No
You have an Azure subscription that contains a web app named webapp1. You need to add a custom domain named www.contoso.com to webapp1.
What should you do first?
- A . Upload a certificate.
- B . Add a connection string.
- C . Stop webapp1.
- D . Create a DNS record.
You have an Azure Storage account named storage1.
You need to enable a user named User1 to list and regenerate storage account keys for storage1.
Solution: You assign the Storage Account Contributor role to User1.
Does this meet the goal?
- A . Yes
- B . No
You have an Azure subscription. The subscription contains virtual machines that connect to a virtual network named VNet1.
You plan to configure Azure Monitor for VM Insights.
You need to ensure that all the virtual machines only communicate with Azure Monitor through VNet1.
What should you create first?
- A . an Azure Monitor Private Link Scope (AMPIS)
- B . a private endpoint
- C . a Log Analytics workspace
- D . a data collection rule (DCR)
You have an Azure subscription that contains the virtual networks shown in the following table.
The subscription contains the virtual machines shown in the following table.
All The virtual machines have only private IP addresses. You deploy an Azure Bastion host named Bastion1 to VNet1.
To which virtual machines can you connect through Bastion1?
- A . VM1 only
- B . VM1 and VM2 only
- C . VM1 and VM3 only
- D . VM1, VM2, and VM3
HOTSPOT
You plan to use Azure Network Watcher to perform the following tasks:
– Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine
– Task2: Validate outbound connectivity from an Azure virtual machine to an external host
Which feature should you use for each task? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
HOTSPOT
You plan to use Azure Network Watcher to perform the following tasks:
Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine
Task2: Validate outbound connectivity from an Azure virtual machine to an external host
Which feature should you use for each task? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
