AZ-104 Questions 91-100: Final Mixed Azure Administrator Review

0
0

Focus keyphrase: AZ-104 practice questions

Use these AZ-104 practice questions to close out the 91-100 range with a realistic mixed review of Microsoft Azure Administrator decisions. The questions emphasize governance, storage permissions, compute operations, networking, private DNS, monitoring, and recovery choices from the AZ-104 objective domains.

These are original exam-style practice items based on public Microsoft exam objectives and official Azure documentation. They are designed to feel realistic without copying, paraphrasing, or reconstructing real exam-dump questions.

AZ-104Questions 91-100Azure AdministratorFinal Mixed Review
Where this fits in the series: This post follows AZ-104 Questions 81-90: Identity, Storage, Compute, Networking, and Monitoring Review. Questions 91-100 continue the sequential AZ-104 administrator practice set with scenario-based questions that mix identity, governance, storage, compute, networking, and monitoring.

AZ-104 Questions 91-100: Final mixed Azure Administrator review

Choose the best answer unless the question says otherwise. Read each requirement carefully: AZ-104 questions often turn on scope, data plane versus management plane, private name resolution, or whether the service is for deployment, monitoring, or recovery.

Governance watch: Azure Policy evaluates and enforces resource rules. Azure RBAC grants permissions. Resource locks protect existing resources from management actions.
Storage watch: Management roles do not automatically grant blob data access. Use the correct data-plane role when the task is reading or writing blob content.
Networking watch: A private endpoint changes the network path, but private DNS is what makes the normal service name resolve to the private IP address.
Exam tip: When two options sound possible, ask: “What is the exact control plane?” Policy for compliance, RBAC for permissions, Network Watcher for diagnosis, diagnostic settings for log routing, and Backup for restore points.
Domain: Manage Azure identities and governance — configure Azure Policy

Question 91: Requiring a cost center tag across subscriptions

Scenario: Your company has several Azure subscriptions under one management group. New resources in any of those subscriptions must include a CostCenter tag at creation time. The rule should apply consistently without assigning separate controls to each resource group.

Choose one answer.

  1. Create a resource lock at the management group scope
  2. Assign an Azure Policy definition or initiative at the management group scope that requires the tag
  3. Assign the Reader role to all users at the subscription scope
  4. Create a Recovery Services vault and configure a backup policy

Correct answer: B — Assign Azure Policy at the management group scope

Explanation: Azure Policy is used to evaluate and enforce resource configuration rules, such as requiring a tag. Assigning the policy at the management group scope applies it to child subscriptions, which avoids repeating the assignment in each resource group.

Why the other options are wrong

  • A. Resource locks prevent management actions such as delete or update; they do not require metadata on new resources.
  • C. Reader affects user permissions and does not enforce tagging.
  • D. Backup protects workloads but does not enforce governance rules.

Official reference: Azure Policy overview and Azure management groups

Domain: Implement and manage storage — assign data access roles

Question 92: Granting blob upload access without sharing account keys

Scenario: A developer needs to upload and overwrite blobs in one container. The developer must not be able to change storage account networking, regenerate access keys, or manage containers outside the assigned scope. You want to use Microsoft Entra authorization instead of shared keys.

Choose one answer.

  1. Assign Storage Account Contributor at the storage account scope
  2. Assign Reader at the subscription scope and provide a shared access signature with account-level permissions
  3. Assign Storage Blob Data Contributor at the container scope
  4. Assign Owner at the resource group scope

Correct answer: C — Assign Storage Blob Data Contributor at the container scope

Explanation: Storage Blob Data Contributor grants read, write, and delete access to blob data. Scoping the assignment to the specific container follows least privilege and avoids granting storage account management permissions.

Why the other options are wrong

  • A. Storage Account Contributor is a management-plane role and is broader than needed; it does not by itself provide the intended least-privilege blob data scope.
  • B. A broad account-level SAS conflicts with the requirement to use Microsoft Entra authorization and least privilege.
  • D. Owner is far too broad and includes permission to manage access.

Official reference: Authorize access to blobs using Microsoft Entra ID and Azure built-in roles for Storage

Domain: Implement and manage storage — configure Azure Files

Question 93: Caching Azure file shares near branch office users

Scenario: A branch office has a Windows file server and many users who access the same project files. The company wants the authoritative copy stored in Azure Files, but users should get low-latency local access in the branch. Changes should synchronize between the local server and the Azure file share.

Choose one answer.

  1. Enable blob versioning on the storage account
  2. Use Azure File Sync with a server endpoint on the branch file server and a cloud endpoint on the Azure file share
  3. Create a public IP address for the storage account
  4. Configure a lifecycle management rule that moves files to the archive tier after 30 days

Correct answer: B — Use Azure File Sync

Explanation: Azure File Sync can centralize file shares in Azure Files while caching frequently used files on Windows Server. A sync group connects the Azure file share cloud endpoint with one or more server endpoints.

Why the other options are wrong

  • A. Blob versioning applies to Blob Storage and does not create a local SMB cache for Azure Files.
  • C. A public IP address is not how Azure Files provides branch caching, and storage accounts use service endpoints rather than assigning a public IP to the account.
  • D. Lifecycle management is for blob lifecycle tiering and does not synchronize file shares to a Windows server.

Official reference: Azure File Sync overview

Domain: Deploy and manage Azure compute resources — configure VM scale sets

Question 94: Automatically adding VM instances during CPU spikes

Scenario: A web application runs on identical VM instances. During business hours, CPU usage can increase suddenly. You need Azure to add instances when average CPU is high and remove instances when demand falls. The configuration should keep at least two instances running.

Choose one answer.

  1. Create an Azure Availability Set and assign all VMs to the same update domain
  2. Create a VM scale set autoscale profile with scale-out and scale-in rules based on Percentage CPU
  3. Create a resource lock on the resource group
  4. Enable boot diagnostics on each VM

Correct answer: B — Configure VM scale set autoscale rules

Explanation: Virtual Machine Scale Sets support autoscale rules that add or remove VM instances based on metrics such as Percentage CPU. Minimum, maximum, and default instance counts control the allowed capacity range.

Why the other options are wrong

  • A. Availability sets help distribute VMs across fault and update domains but do not automatically add or remove instances.
  • C. A resource lock protects resources from management changes; it does not respond to load.
  • D. Boot diagnostics helps troubleshooting but does not scale compute capacity.

Official reference: Autoscale with Azure Virtual Machine Scale Sets

Domain: Deploy and manage Azure compute resources — deploy containers

Question 95: Running a short-lived container without managing orchestration

Scenario: A team needs to run a containerized data-processing job on demand. The job usually completes in less than 15 minutes. The team does not want to manage Kubernetes clusters, virtual machines, or an App Service plan for this workload.

Choose one answer.

  1. Deploy the container image to Azure Container Instances
  2. Create an Azure Kubernetes Service cluster with three node pools
  3. Create a virtual machine and install Docker manually
  4. Create an availability set and add the container image to it

Correct answer: A — Deploy to Azure Container Instances

Explanation: Azure Container Instances is suitable for running containers without managing servers or orchestrators. It works well for simple, isolated, event-driven, or short-lived container workloads.

Why the other options are wrong

  • B. AKS is useful for orchestrated, multi-container platforms but adds cluster management overhead for a simple on-demand job.
  • C. A VM requires operating system and container runtime management.
  • D. Availability sets are for VM placement and do not run container images.

Official reference: Azure Container Instances overview

Domain: Configure and manage virtual networking — route traffic through a hub firewall

Question 96: Inspecting traffic between spoke virtual networks

Scenario: You have a hub-and-spoke network. SpokeA and SpokeB are peered with HubVNet. Azure Firewall is deployed in the hub. Traffic between the two spokes must be inspected by the firewall before it reaches the other spoke.

Choose one answer.

  1. Enable blob soft delete on the storage account used by the firewall logs
  2. Create user-defined routes in the spoke subnets that send traffic for the other spoke address space to the firewall private IP address, and allow forwarded traffic as required by the peering design
  3. Assign the Network Contributor role to every VM in both spokes
  4. Delete the hub virtual network and peer SpokeA directly to SpokeB only

Correct answer: B — Use UDRs to route spoke-to-spoke traffic through the hub firewall

Explanation: VNet peering is not transitive routing by itself. To inspect spoke-to-spoke traffic through a central firewall, route tables in the spoke subnets commonly send the relevant prefixes to the firewall as a virtual appliance next hop, with peering settings that support forwarded traffic for the design.

Why the other options are wrong

  • A. Storage protection for logs does not affect network routing.
  • C. RBAC grants management permissions; it does not steer packet flow.
  • D. Direct peering bypasses the central hub inspection requirement.

Official reference: Deploy and configure Azure Firewall using the Azure portal and Virtual network traffic routing

Domain: Configure and manage virtual networking — configure private DNS

Question 97: Resolving a private endpoint from a peered virtual network

Scenario: A storage account has a private endpoint in VNet1. VMs in VNet1 can resolve the storage account name to the private endpoint IP address. VMs in peered VNet2 still resolve the same name to a public address. You need VMs in VNet2 to resolve the storage account name to the private endpoint address.

Choose one answer.

  1. Link the appropriate Azure Private DNS zone for the private endpoint to VNet2
  2. Assign Storage Blob Data Reader to the VMs in VNet2
  3. Create an additional public IP address for the storage account
  4. Enable accelerated networking on all VMs in VNet2

Correct answer: A — Link the private DNS zone to VNet2

Explanation: Private endpoint name resolution typically uses an Azure Private DNS zone, such as the storage subresource zone, linked to the virtual networks that need private resolution. Linking the zone to VNet2 allows clients there to resolve the service name to the private endpoint address.

Why the other options are wrong

  • B. RBAC affects authorization to data, not DNS resolution.
  • C. A public IP address does not help clients resolve to a private endpoint IP.
  • D. Accelerated networking changes VM network performance characteristics; it does not manage DNS records.

Official reference: Azure Private Endpoint DNS configuration

Domain: Configure and manage virtual networking — troubleshoot connectivity

Question 98: Determining whether an NSG blocks outbound traffic

Scenario: A VM cannot connect to a database endpoint on TCP port 1433. You suspect a network security group rule is blocking traffic from the VM network interface. You need to test whether traffic is allowed or denied for the specific source, destination, protocol, and port.

Choose one answer.

  1. Use Azure Network Watcher IP flow verify
  2. Use Azure Advisor cost recommendations
  3. Create an Azure Policy assignment that audits missing tags
  4. Enable Microsoft Defender for Cloud regulatory compliance standards

Correct answer: A — Use IP flow verify

Explanation: Network Watcher IP flow verify checks whether a packet is allowed or denied to or from a VM based on configured security rules. It can identify the rule that allows or blocks the tested flow.

Why the other options are wrong

  • B. Azure Advisor cost recommendations do not diagnose packet filtering.
  • C. Azure Policy can audit or enforce resource configuration but does not test an individual network flow.
  • D. Defender for Cloud compliance views do not replace NSG flow troubleshooting.

Official reference: IP flow verify overview

Domain: Monitor and maintain Azure resources — collect platform logs

Question 99: Sending resource logs to a Log Analytics workspace

Scenario: Security operations wants to query platform logs from an Azure Key Vault in a Log Analytics workspace. The team also wants to retain a copy of the logs in a storage account for long-term archive. You need to configure log routing from the Key Vault resource.

Choose one answer.

  1. Create a metric alert rule with a static threshold
  2. Configure a diagnostic setting on the Key Vault to send selected logs to Log Analytics and archive them to the storage account
  3. Assign the Reader role to the Log Analytics workspace managed identity
  4. Create an availability set for the Key Vault

Correct answer: B — Configure a diagnostic setting

Explanation: Diagnostic settings route platform logs and metrics from supported Azure resources to destinations such as Log Analytics workspaces, storage accounts, and event hubs. This matches the requirement to query logs and archive them.

Why the other options are wrong

  • A. A metric alert can notify on a metric condition but does not route logs to Log Analytics and storage.
  • C. RBAC alone does not configure log export from the resource.
  • D. Availability sets apply to virtual machines, not Key Vault log routing.

Official reference: Diagnostic settings in Azure Monitor

Domain: Monitor and maintain Azure resources — configure backup and recovery

Question 100: Restoring an Azure VM after accidental deletion

Scenario: An Azure VM is protected by Azure Backup in a Recovery Services vault. An administrator accidentally deletes the VM. You need to restore the VM from a recovery point with its disks and configuration as quickly as possible.

Choose one answer.

  1. Use the Azure VM Restore option from the Recovery Services vault and select an appropriate recovery point
  2. Create an Azure Policy remediation task for missing tags
  3. Use IP flow verify against the deleted VM network interface
  4. Enable blob lifecycle management on the storage account that contains boot diagnostics logs

Correct answer: A — Restore the VM from Azure Backup

Explanation: Azure Backup stores recovery points for protected Azure VMs in a Recovery Services vault. From the vault, you can restore a VM or restore disks from a selected recovery point, depending on the recovery requirement.

Why the other options are wrong

  • B. Azure Policy remediation helps correct policy noncompliance; it does not restore deleted VM disks and configuration.
  • C. IP flow verify is for network troubleshooting and cannot test a deleted VM.
  • D. Lifecycle management for boot diagnostics logs does not restore a VM.

Official reference: Restore Azure VMs using Azure Backup

Answer key: AZ-104 questions 91-100

Question Correct answer Objective focus
91 B Azure Policy assignment scope and required tags
92 C Blob data-plane RBAC and least privilege
93 B Azure File Sync and branch caching
94 B VM scale set autoscale rules
95 A Azure Container Instances for simple container jobs
96 B User-defined routes through Azure Firewall
97 A Private endpoint DNS zone links
98 A Network Watcher IP flow verify
99 B Azure Monitor diagnostic settings
100 A Azure Backup VM restore
Watch out: AZ-104 distractors often swap the right product family with the wrong task. A role assignment cannot make DNS private. A diagnostic setting routes logs but does not create a restore point. A resource lock is not a backup strategy. Keep the requirement tied to the service purpose.

Sources

📚 More questions from: AZ-104: Azure Administrator

Related QuestionMORE FROM AUTHOR