Free Microsoft AZ-104 Practice Questions & Answers 2026 Part4 | Microsoft Azure Administrator

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company has an Azure Active Directory (Azure AD) subscription.You want to implement an Azure AD conditional access policy.The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.Does the solution meet the goal?

You have an Azure subscription that contains the resources shown in the following table.You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1.Which role should you assign?

How many days of data retention is free for Log Analytics, which stores the Linux Syslog?

You have a Microsoft Entra tenant that contains the groups shown in the following table.You purchase Microsoft Entra ID P2 licenses. To which groups can you assign a license?

You are planning the move of App1 to Azure.You create a network security group (NSG).You need to recommend a solution to provide users with access to App1.What should you recommend?

You have a Microsoft Entra tenant that contains the groups shown in the following table.You purchase Microsoft Entra ID P2 licenses. To which groups can you assign a license?

You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort.What should you do?

You have a Microsoft Entra tenant named contoso.onmicrosoft.com. The User administrator role is assigned to a user named Admin1.An external partner has a Microsoft account that uses the user1@outlook.com sign in.Admin1 attempts to invite the external partner to sign in to the Microsoft Entra tenant and receives the following error message: “Unable to invite user user1@outlook.com – Generic authorization exception.”You need to ensure that Admin1 can invite the external partner to sign in to the Microsoft Entra tenant. What should you do?

Your company has an Azure Active Directory (Azure AD) subscription.You need to deploy five virtual machines (VMs) to your company’s virtual network subnet.The VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these virtual machines must be identical.Which of the following is the least amount of security groups needed for this configuration?

Your company has an Azure Active Directory (Azure AD) subscription.You need to deploy five virtual machines (VMs) to your company’s virtual network subnet.The VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these virtual machines must be identical.Which of the following is the least amount of network interfaces needed for this configuration?

You have an Azure DNS zone named adatum.com.You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Storage account named storage1. You need to enable a user named User1 to list and regenerate storage account keys for storage I. Solution: You assign the Reader and Data Access role to User1. Does this meet the goal?

A company has started using Azure and set up a subscription. They want to see the costs being incurred for each type of resource. Which of the following can help you get these details?

You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.A user named User1 has the following roles for Subscription1: ReaderSecurity Admin Security ReaderYou need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

You have a Microsoft 365 tenant and a Microsoft Entra tenant named contoso.com.You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.Which two groups should you create? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

You have a Microsoft Entra tenant that contains the groups shown in the following table.You purchase Microsoft Entra ID P2 licenses. To which groups can you assign a license?

You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements. Which storage account should you identify? You must identify the correct storage account for flow logging of IP traffic from VM5 that satisfies the retention requirement of eight months. Step 1 --- Review the Requirements Flow logs are stored in a StorageV2 (general purpose v2) account. The selected storage account must support Network Watcher flow logs. Data must be retained for eight months ( 240 days). Step 2 --- Evaluate Each Storage Account Storage Account Kind Region Remarks storage1 Storage (general purpose v1) West US Does not support flow logs (deprecated type). storage2 StorageV2 (general purpose v2) East US Fully supports flow logs and lifecycle management. storage3 BlobStorage East US 2 Not suitable --- supports blobs only, not log structure or lifecycle retention. storage4 FileStorage Central US File-only --- cannot store flow logs. Step 3 --- Compliance with Flow Log Retention Flow logs for Network Watcher NSG flow logging are supported only by StorageV2 accounts. You can use Azure Storage lifecycle management to automatically delete logs after a set period --- such as 240 days (8 months) --- to comply with retention requirements. Official Microsoft Note: ''Network security group (NSG) flow logs are stored in Azure StorageV2 (General Purpose v2) accounts, which support lifecycle management for log retention.'' --- Azure Network Watcher documentation. Conclusion storage2 is the only StorageV2 account. It's located in East US, matching VM5's region (East US) --- this satisfies performance and compliance requirements.

You have an Azure subscription that contains the resources shown in the following table.All virtual machines run Windows Server.On VM1, you back up a folder named Folder! as shown in the following exhibitYou plan to restore the backup to a different virtual machine.You need to restore the backup to VM2.What should you do first?

You have an Azure Active Directory (Azure AD) tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users.You need to create a quest user account in contoso.com for each of the 500 external users.Solution: from Azure AD in the Azure portal, you use the Bulk create user operation.Does this meet the goal?

You have a registered DNS domain named contoso.com. You create a public Azure DNS zone named contoso.com.You need to ensure that records created in the contoso.com zone are resolvable from the internet. What should you do?

You administer a solution in Azure that is currently having performance issues.You need to find the cause of the performance issues pertaining to metrics on the Azure infrastructure. Which of the following is the tool you should use?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft Entra tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each user.Does this meet the goal?

You have a Microsoft Entra tenant that contains the groups shown in the following table.You purchase Microsoft Entra ID P2 licenses. To which groups can you assign a license?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish ifthe solution satisfies the requirements.Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises ActiveDirectory domain.You have a server named DirSync1 that is configured as a DirSync server.You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.Solution: You use Active Directory Sites and Services to force replication of the Global Catalog on a domain controller.Does the solution meet the goal?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, thesequestions will not appear in the review screen.You have a Microsoft Entra tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: From Microsoft Entra ID in the Azure portal, you use the Bulk invite users operation. Does this meet the goal?

You have an Azure subscription that contains the resources shown in the following table.You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1.Which role should you assign?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription that contains the following users in a Microsoft Entra tenant named contoso.onmicrosoft.com:User1 creates a new Microsoft Entra tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com.Solution: You instruct User3 to create the user accounts. Does that meet the goal?

You have three offices and an Azure subscription that contains a Microsoft Entra tenant. You need to grant user management permissions to a local administrator in each office. What should you use?

Your company has an Azure subscription that includes a Recovery Services vault.You want to use Azure Backup to schedule a backup of your company's virtual machines (VMs) to the Recovery Services vault.Which of the following VMs can you back up? Choose all that apply.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have a Microsoft Entra tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each user.Does this meet the goal?

You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.A user named User1 has the following roles for Subscription1: ReaderSecurity Admin Security ReaderYou need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

In which format are NSG flow logs stored?

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You need to ensure that a Microsoft Entra user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.Solution: You assign the Owner role at the subscription level to Admin1. Does this meet the goal?

What is the maximum number of Recovery Services vaults that can be created in each region?

When the backups are deleted, how long are they preserved under soft delete?

You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit. The planned disk configurations for VM1 are shown in the following exhibit. You need to ensure that VM1 can be created in an Availability Zone. Which two settings should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

You have an Azure subscription that contains the resources shown in the following table.You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1.Which role should you assign?

You have an Azure subscription.You have 100 Azure virtual machines.You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering.Which blade should you use?

You have an Azure subscription that contains a storage account named storage.You have the devices shown in the following table.From which devices can you use AzCopy to copy data to storage1?

Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.Your company makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.To achieve this, the Per Enabled User setting must be set for the usage model.Solution: You reconfigure the existing usage model via the Azure portal.Does the solution meet the goal?

You are planning to deploy an Ubuntu Server virtual machine to your company's Azure subscription.You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA).Which of the following should you use to create the virtual machine?