1500 Questions | Azure Administrator (AZ-104)

Implement and Manage Storage (15–20%): Configuring Azure Files, Blob Storage, and data security.

Deploy and Manage Azure Compute Resources (20–25%): Managing Virtual Machines, Containers, and App Services.

Configure and Manage Virtual Networking (20–25%): Implementing VNets, DNS, Network Security Groups, and Load Balancers.

Monitor and Maintain Azure Resources (10–15%): Using Azure Monitor, Log Analytics, and Backup/Recovery strategies.

B. An Azure Policy with an "Allowed virtual machine size SKUs" definition.

C. An Azure Role-Based Access Control (RBAC) role assignment.

D. A Management Group with cost alerts.

E. A tags-only requirement on the Resource Group.

F. An Azure Blueprint with a specific ARM template.

Correct Answer: B

Explanation:

A (Incorrect): Resource Locks prevent accidental deletion or modification but do not control the type or size of resources being created.

C (Incorrect): RBAC controls who can do something, but Policy controls what can be done to the resources themselves.

D (Incorrect): Management Groups help organize subscriptions but don't inherently restrict VM SKUs without an attached Policy.

E (Incorrect): Tags are for metadata and organization, they cannot stop a user from deploying an unapproved VM size.

F (Incorrect): Blueprints can deploy policies, but the policy itself is what enforces the SKU restriction.

Question 2: You are configuring Azure File Sync. You have an on-premises server named Server1 that contains a share named Data. You need to sync the Data share to an Azure file share. Which component must you install on Server1 first?

B. The Azure File Sync agent.

C. The Azure Storage Explorer.

D. The AzCopy utility.

E. A VPN Gateway client.

F. Microsoft Entra Connect.

Correct Answer: B

Explanation:

A (Incorrect): PowerShell is used for management, but it is not the background service that performs the synchronization.

C (Incorrect): Storage Explorer is a GUI for viewing files, not a synchronization engine.

D (Incorrect): AzCopy is for one-time or scheduled data transfers, not continuous file synchronization.

E (Incorrect): While a VPN may be used for security, it is not a prerequisite for the File Sync service itself.

F (Incorrect): Entra Connect is for identity synchronization, not file system data.

Question 3: You have a virtual network named VNET1 that contains two subnets: SubnetA and SubnetB. You need to block all traffic from SubnetA to SubnetB while allowing SubnetB to access the internet. What is the most efficient way to achieve this?

B. Modify the default Azure Firewall rules.

C. Create a Network Security Group (NSG) and associate it with SubnetB.

D. Disable VNET peering between the subnets.

E. Enable Service Endpoints on SubnetA.

F. Use a Virtual Network Gateway.

Correct Answer: C

Explanation:

A (Incorrect): Routes determine where traffic goes, but NSGs are better suited for "Allow/Deny" security logic.

B (Incorrect): Azure Firewall is powerful but "less efficient" for simple internal subnet filtering compared to a free NSG.

D (Incorrect): Subnets in the same VNET are not peered; they have default connectivity that cannot be "deleted" like a peering link.

E (Incorrect): Service Endpoints are used to secure Azure Services (like SQL or Storage) to a VNET, not for subnet-to-subnet filtering.

F (Incorrect): Gateways are for cross-premises or VNET-to-VNET connectivity, not internal subnet security.

This is a huge original question bank

You get support from instructors if you have questions

Each question has a detailed explanation

Mobile-compatible with the Udemy app

30-days money-back guarantee if you're not satisfied