Nail Your AZ-104 Azure Administrator Exam on the First Try

Explanation

Scenario:

1. Web administrators will deploy Azure web apps for the marketing department.

2. Each web app will be added to a separate resource group.

3. The initial configuration of the web apps will be identical.

4. The web administrators have permission to deploy web apps to resource groups.

Steps:

1 -- > Create a resource group, and then deploy a web app to the resource group.

2 -- > From the Automation script blade of the resource group , click Add to Library.

3 -- > From the Templates service, select the template, and then share the template to the web administrators .

Box 1: Selected

Only selected users should be able to join devices

Box 2: Yes

Require Multi-Factor Auth to join devices.

From scenario:

Ensure that only users who are part of a group named Pilot can join devices to Azure AD

Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

In this scenario, App1 consists of three distinct tiers — web front end, processing middle tier, and SQL database — each containing five virtual machines. The technical requirement specifies that the company must minimize the number of open ports between the App1 tiers, move all tiers of App1 to Azure, and ensure that all VMs are protected by backups.

According to Microsoft Azure architecture best practices for multi-tier applications (from Azure Architecture Center and the Azure Administrator curriculum), the optimal design involves:

Deploying all tiers of App1 into a single virtual network (VNet).

This allows all components of the application to communicate securely using private IP addresses.

Keeping all tiers within a single VNet simplifies management, security, and monitoring while supporting Network Security Groups (NSGs) for inter-tier traffic control.

Microsoft Documentation Extract:

“Use a single virtual network to host multi-tier applications. Divide the virtual network into multiple subnets, each representing a tier, and use network security groups (NSGs) to control traffic flow between tiers.”

(Source: Microsoft Learn – Design and implement virtual networks in Azure)

Creating separate subnets for each application tier (3 total).

Subnet 1: Web tier (internet-facing, HTTPS traffic)

Subnet 2: Application/Processing tier (internal communication only)

Subnet 3: Database tier (private, no internet access)

Using NSGs, administrators can explicitly allow or deny traffic between subnets, thus minimizing open ports between tiers and meeting the security requirement.

Microsoft Documentation Extract:

“Subnets provide isolation and segmentation within a virtual network. Each tier of an application should be deployed in its own subnet to apply network security policies and control exposure.”

(Source: Microsoft Learn – Azure virtual network design best practices)

Backups and Storage Requirements:

All VMs can use Azure Backup integrated with Recovery Services Vaults, which supports VM-level backup in a single VNet environment.

The blueprint files are stored in Azure Blob Storage with the archive tier, ensuring compliance with the storage and access control requirements.

By using one virtual network and three subnets, Contoso ensures efficient management, minimized administrative overhead, secure isolation of application tiers, and full compliance with Azure governance and security recommendations.

✅ Final Verified Answer:

Number of virtual networks: 1

Number of subnets: 3

Statement 1: Yes

Contoso is moving the existing product blueprint files to Azure Blob storage which will ensure that the blueprint files are stored in the archive storage tier.

Use unmanaged standard storage for the hard disks of the virtual machines. We use Page Blobs for these.

Statement 2: No

Azure Table storage stores large amounts of structured data. The service is a NoSQL datastore which accepts authenticated calls from inside and outside the Azure cloud. Azure tables are ideal for storing structured, non-relational data. Common uses of Table storage include:

1. Storing TBs of structured data capable of serving web scale applications

2. Storing datasets that don ' t require complex joins, foreign keys, or stored procedures and can be denormalized for fast access

3. Quickly querying data using a clustered index

4. Accessing data using the OData protocol and LINQ queries with WCF Data Service .NET Libraries

Statement 3: No

File Storage can be used if your business use case needs to deal mostly with standard File extensions like *.docx, *.png and *.bak then you should probably go with this storage option.

Active Directory Federation Services is a feature and web service in the Windows Server Operating System that allows sharing of identity information outside a company’s network.

Scenario: Technical Requirements include:

Prevent user passwords or hashes of passwords from being stored in Azure.

To prepare Vault1 for Azure Disk Encryption, you need to perform the following actions on Vault1:

Create a new key. A key encryption key (KEK) is an encryption key that is used to encrypt the encryption secrets before they are stored in the key vault. You can create a new KEK by using the Azure CLI, the Azure PowerShell, or the Azure portal1. You can also import an existing KEK from another source, such as a hardware security module (HSM)2. The KEK must be a 2048-bit RSA key or a 256-bit AES key3.

Select Azure Disk Encryption for volume encryption. This is an advanced access policy setting that enables Azure Disk Encryption to access the keys and secrets in the key vault. You can select this setting by using the Azure CLI, the Azure PowerShell, or the Azure portal4. You must also enable access to Microsoft Trusted Services if you have enabled the firewall on the key vault.

In this scenario, Contoso Ltd. must designate a new user named Admin1 as the service administrator of the Azure subscription and ensure that Admin1 receives email alerts about service outages.

In Azure, there are three classic administrative roles associated with subscriptions:

Account Administrator – The individual who created the subscription and manages billing.

Service Administrator – The primary contact responsible for managing services and resources in the subscription.

Co-Administrator – Has the same management privileges as the Service Administrator but cannot change subscription associations.

According to Microsoft Azure Administrator documentation, to change the Service Administrator, you must perform the following steps:

In the Azure portal, navigate to Subscriptions.

Select the specific subscription.

Under Settings, choose Properties.

In the Service Administrator field, update the name and email address to that of the new administrator (in this case, Admin1).

This modification ensures that Admin1 becomes the Service Administrator, and Azure will automatically send service-related notifications and outage alerts to that user’s registered email address, as defined by Microsoft’s subscription notification process.

Option B (IAM settings) is used for Role-Based Access Control (RBAC) and assigning Azure Resource Manager roles such as Owner, Contributor, or Reader. However, RBAC roles do not change the Service Administrator at the subscription level — that’s only done through the Properties blade.

Options C (AAD Properties) and D (AAD Groups) are unrelated to subscription-level administrative settings.

Therefore, the verified and Microsoft-documented answer is:

✅ A. From the Subscriptions blade, select the subscription, and then modify the Properties.

Final Verified Answer: ✅ A. From the Subscriptions blade, select the subscription, and then modify the Properties.

A Recovery Services vault is a logical container that stores the backup data for each protected resource, such as Azure VMs. When the backup job for a protected resource runs, it creates a recovery point inside the Recovery Services vault.

Scenario:

There are three application tiers, each with five virtual machines.

Move all the virtual machines for App1 to Azure.

Ensure that all the virtual machines for App1 are protected by backups.

As App1 is public-facing we need an incoming security rule, related to the access of the web servers.

Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier.

Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

NO

NO

YES

The provided ARM template defines an Azure Storage Account resource with the following key properties:

{

" type " : " Microsoft.Storage/storageAccounts " ,

" name " : " storage1 " ,

" location " : " East US " ,

" properties " : {

" allowBlobPublicAccess " : true,

" defaultToOAuthAuthentication " : false,

" networkAcls " : {

" bypass " : " AzureServices " ,

" defaultAction " : " Allow " ,

" ipRules " : []

},

" isVersioningEnabled " : true

}

}

Let’s analyze each statement based on Azure Storage behavior and documentation:

Statement 1: “Changes made to the data in storage1 can be rolled back after seven days.”

❌ Incorrect

The property " isVersioningEnabled " : true refers to blob versioning, which maintains previous versions of objects (blobs) when they are modified or deleted. However, there is no automatic seven-day rollback period. Versions remain indefinitely until manually deleted or managed via lifecycle policies.

Microsoft documentation:

“When blob versioning is enabled, Azure Storage automatically maintains previous versions of an object. You can restore a previous version manually, but there is no automatic rollback period.”

Hence, changes can be rolled back manually, not automatically after seven days.

Statement 2: “Only users located in the East US Azure region can connect to storage1.”

❌ Incorrect

The networkAcls section specifies:

" defaultAction " : " Allow " ,

" bypass " : " AzureServices " ,

" ipRules " : []

This configuration means all network access is allowed by default ( " defaultAction " : " Allow " ). There are no IP restrictions, so users from any region can connect.

Azure documentation states:

“If the defaultAction is set to Allow, traffic from all networks can access the storage account unless specific network rules are added.”

Therefore, access is not restricted to the East US region.

Statement 3: “Three copies of storage1 will be maintained in the East US Azure region.”

✅ Correct

By default, if redundancy options like ZRS or GRS are not specified, Azure Storage uses Locally Redundant Storage (LRS).

From the Microsoft study guide:

“Locally Redundant Storage (LRS) maintains three synchronous copies of your data within a single datacenter in the primary region.”

Since the location is " East US " and no redundancy property is explicitly defined, the default LRS applies — meaning three copies within the same region (East US).