Microsoft Azure Administrator Associate (AZ-104) Practice Questions & Study Guide

Free Microsoft Azure Administrator Associate (AZ-104) Practice Questions Preview

• Question 1

  Your company has serval departments. Each department has a number of virtual machines (VMs).
  The company has an Azure subscription that contains a resource group named RG1.
  All VMs are located in RG1.
  You want to associate each VM with its respective department.
  What should you do?
  

  • A. Create Azure Management Groups for each department.
  • B. Create a resource group for each department.
  • C. Assign tags to the virtual machines.
  • D. Modify the settings of the virtual machines.

  Correct Answer: C

  Explanation:

  The recommended solution is to C. Assign tags to the virtual machines.
  
  Reasoning:
  Tags are key-value pairs that you can apply to Azure resources to logically organize them. In this scenario, since all VMs are within the same resource group (RG1), tags provide a mechanism to associate each VM with its respective department without restructuring the resource groups. This approach allows for easy filtering, reporting, and management based on department.
  
  Using tags will allow you to logically organize your resources by department within the existing resource group.
  
  Reasons for not choosing the other options:

  • A. Create Azure Management Groups for each department: Management groups are used for managing access, policy, and compliance across multiple subscriptions. While useful for larger organizational structures, they are overkill for simply associating VMs with departments within a single subscription and resource group.
  • B. Create a resource group for each department: Creating a resource group for each department would involve moving VMs between resource groups, which can be disruptive and may not be desirable if the VMs share dependencies or configurations. The question specifies that all VMs are currently in RG1, and the goal is to associate them with departments *without* implying a restructuring is necessary.
  • D. Modify the settings of the virtual machines: While you could potentially add department information to the VM's description or a custom configuration, tags are specifically designed for metadata and provide better querying and management capabilities within Azure. Modifying VM settings is also not as easily searchable or manageable as tags.

  In summary, tagging is the most efficient and appropriate method for associating VMs with departments within the same resource group.

  
  

  Citations:

  • Azure Tags: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources

• Question 2

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company has an Azure Active Directory (Azure AD) subscription.
  You want to implement an Azure AD conditional access policy.
  The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.
  Solution: You access the multi-factor authentication page to alter the user settings.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: B

  Explanation:

  The suggested answer is B (No).
  
  Reasoning: The solution is incorrect because modifying user settings directly on the multi-factor authentication page does not fulfill the requirement of creating a Conditional Access policy that enforces MFA and requires Azure AD-joined devices when Global Administrators connect from untrusted locations. The proper way to achieve the goal is to configure a Conditional Access policy.
  
  Why other options are wrong: Option A (Yes) is incorrect because directly modifying MFA settings does not provide the granular control and conditions needed to meet the stated requirements. Conditional Access policies are designed to handle such complex scenarios.
  
  To correctly implement the requirements, one should create a new Conditional Access policy, target the Global Administrators group, specify conditions like MFA and require Azure AD-joined device registration for untrusted locations, and then enable the policy.

  • Citations:
  • Conditional Access Documentation, https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/

• Question 3

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company has an Azure Active Directory (Azure AD) subscription.
  You want to implement an Azure AD conditional access policy.
  The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.
  Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: B

  Explanation:

  The solution does not meet the goal. The suggested answer is B (No).
  
  The reason for this is that the requirement specifies that members of the Global Administrators group must use Multi-Factor Authentication (MFA) and an Azure AD-joined device when connecting from untrusted locations. Configuring the session control of the Azure AD conditional access policy is insufficient to enforce these requirements. Session controls are applied *after* authentication, whereas the requirement is to enforce MFA and device compliance *during* authentication.
  
  Instead, the correct approach is to configure the access control to "Grant access" based on satisfying the MFA and device compliance requirements. Session controls are more about what a user can do *during* a session (e.g., download restrictions), not *whether* they can gain access initially.
  
  Therefore, the reason for not choosing A (Yes) is that altering the session control does not address the primary requirement of enforcing MFA and requiring an Azure AD-joined device for access from untrusted locations; access controls should be used to enforce such requirements.

  • Citation Conditional Access documentation, https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/

• Question 4

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company has an Azure Active Directory (Azure AD) subscription.
  You want to implement an Azure AD conditional access policy.
  The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.
  Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: A

  Explanation:

  The suggested answer is A: Yes.
  
  Reasoning: The question asks if accessing the Azure portal to alter the grant control of the Azure AD conditional access policy meets the goal. The goal is to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations. While the initial statement is vague, the Azure Portal is the correct place to configure a conditional access policy. The specific steps to fully implement the policy aren't detailed, but simply accessing the Azure portal to modify the grant controls is a necessary (and correct) first step. It's implied that further configuration would follow.
  
  The alternative answer, "No," is less suitable because it suggests that using the Azure portal is not the correct approach, which is incorrect. Conditional Access policies are configured and managed via the Azure Portal.
  
  Therefore, the solution does meet the goal, as accessing the Azure portal is the correct first step in configuring the conditional access policy.

  • To elaborate: Accessing the Azure Portal and modifying the Conditional Access Policy is the correct method, implying subsequent configuration steps would be taken to enforce MFA and device compliance.

  
  
  Reasons for not choosing B:

  • The question describes one of the necessary steps in configuring a Conditional Access policy - using the Azure portal to modify the policy. It does not state this is the *only* step taken.
  • Saying "No" implies that the Azure portal is *not* the right place to start, which is factually incorrect.

  • Conditional Access in Azure Active Directory, https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

• Question 5

  You are planning to deploy an Ubuntu Server virtual machine to your company's Azure subscription.
  You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA).
  Which of the following should you use to create the virtual machine?
  

  • A. The New-AzureRmVm cmdlet.
  • B. The New-AzVM cmdlet.
  • C. The Create-AzVM cmdlet.
  • D. The az vm create command.

  Correct Answer: D

  Explanation:

  The recommended answer is D) The az vm create command.
  
  Reasoning: The az vm create command is the most appropriate choice because it allows for the creation of a virtual machine with custom configurations, including the addition of a trusted root certification authority (CA). This can be achieved by using custom scripts or cloud-init configurations during the VM deployment process. The Azure CLI offers flexibility in configuring the VM according to specific requirements.
  
  Reasons for not choosing other options:

  • A) The New-AzureRmVm cmdlet: This is a legacy PowerShell cmdlet and is not the recommended approach for creating VMs in modern Azure environments.
  • B) The New-AzVM cmdlet: While a valid PowerShell cmdlet, it is generally less flexible than the Azure CLI for incorporating custom scripts or configurations required for adding a trusted root CA during deployment.
  • C) The Create-AzVM cmdlet: This cmdlet does not exist in the Azure PowerShell module.

  • Title: az vm create | Microsoft Learn, https://learn.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest#az-vm-create

• Question 6

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.
  After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.
  To achieve this, the Per Enabled User setting must be set for the usage model.
  Solution: You reconfigure the existing usage model via the Azure portal.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: B

  Explanation:

  The solution proposes reconfiguring the existing Multi-Factor Authentication (MFA) usage model via the Azure portal to switch from "Per Authentication" to "Per Enabled User". However, this is not possible.
  
  Therefore, the answer is B. No.
  
  Reasoning:

  • You cannot change the MFA usage model (per-enabled user or per-authentication) after the MFA provider is created. Once configured, the usage model is fixed, and a new MFA provider or Conditional Access policy would be required to achieve the desired outcome.

  Reasons for not choosing other answers:

  • A. Yes: This is incorrect because the usage model cannot be directly reconfigured via the Azure portal after it has been initially set.

  
  To implement MFA for the newly acquired employees, a different approach is needed such as Conditional Access policies or creating a new MFA provider with the correct usage model.

  
  Citations:

  • Azure AD Multi-Factor Authentication, https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

• Question 7

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.
  After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.
  To achieve this, the Per Enabled User setting must be set for the usage model.
  Solution: You reconfigure the existing usage model via the Azure CLI.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: B

  Explanation:

  The solution does not meet the goal. The suggested answer is B (No).
  Reasoning:
  The core issue is that once a Multi-Factor Authentication (MFA) provider is configured with a specific usage model (in this case, "Per Authentication"), it cannot be directly changed to a different usage model ("Per Enabled User") via the Azure CLI or any other means.
  The question states that the existing setup uses the "Per Authentication" model, and the goal is to have the new employees use "Per Enabled User." Attempting to simply reconfigure the existing provider will not achieve this, as the usage model is immutable after creation.
  To achieve the desired outcome, you would likely need to implement a separate MFA configuration or policy specifically for the new users, potentially involving conditional access policies or other Azure AD features.

  Reasons for not choosing A (Yes):
  The solution attempts to reconfigure the existing MFA provider, which is not possible as the usage model is immutable after creation. Therefore, the solution does not meet the goal.

  • Changing MFA settings requires a more nuanced approach than simply reconfiguring the existing usage model.

  Citations:

  • Azure Multi-Factor Authentication pricing, https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-licensing

• Question 8

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.
  After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.
  To achieve this, the Per Enabled User setting must be set for the usage model.
  Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: B

  Explanation:

  The suggested answer is B (No).
  The solution does not meet the goal because creating a new Multi-Factor Authentication provider is not the correct approach, and it is in fact, no longer possible since September 1st, 2018. While existing MFA providers can still be used, they cannot be updated. The correct approach would involve leveraging Azure AD Conditional Access policies to enforce MFA for the newly added employees.
  
  Reasoning:

  • Creating a new MFA provider is deprecated: According to Microsoft, creating new MFA providers is no longer supported.
  • Conditional Access is the recommended approach: Azure AD Conditional Access policies provide a more flexible and modern way to enforce MFA based on various conditions, such as user, location, device, and application.
  • Azure AD Premium is required: To use Conditional Access for MFA, you need an Azure AD Premium license.

  
  Reasons for not choosing A (Yes):

  • The proposed solution of creating a new MFA provider is not viable.
  • The appropriate method involves using Conditional Access policies within Azure AD, not creating a new MFA provider instance.

  Citations:

  • Azure AD Multi-Factor Authentication: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
  • Conditional Access: https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview

• Question 9

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active
  Directory domain.
  You have a server named DirSync1 that is configured as a DirSync server.
  You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.
  Solution: You run the Start-ADSyncSyncCycle -PolicyType Initial PowerShell cmdlet.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: B

  Explanation:

  The suggested answer is B: No.
  Reasoning for choosing "No": Although `Start-ADSyncSyncCycle -PolicyType Initial` will eventually sync the user, it initiates a full synchronization. A full synchronization is not necessary and is time-consuming for just one user. The question specifies needing to replicate the user information to Azure AD immediately. While an initial sync *will* work, a delta sync is more appropriate for immediate synchronization of a single new user. Using the initial policy type will take a longer time.
  Reasoning against choosing "Yes": While running `Start-ADSyncSyncCycle -PolicyType Initial` *will* replicate the user information, it is not the most efficient method for immediate synchronization of a single user. The "Initial" policy type triggers a full sync, which is resource-intensive and time-consuming compared to a delta sync. Therefore, it doesn't fully meet the requirement of immediate synchronization. A delta sync would be more appropriate and faster.

  Citations:

  • Azure AD Connect sync: Scheduler, https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sync-scheduler
  • Start-ADSyncSyncCycle, https://learn.microsoft.com/en-us/powershell/module/adsync/?view=azureadps-2.0

• Question 10

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
  Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active
  Directory domain.
  You have a server named DirSync1 that is configured as a DirSync server.
  You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.
  Solution: You use Active Directory Sites and Services to force replication of the Global Catalog on a domain controller.
  Does the solution meet the goal?
  

  • A. Yes
  • B. No

  Correct Answer: B

  Explanation:

  The solution does not meet the goal.
  
  Reasoning:
  Using Active Directory Sites and Services to force replication of the Global Catalog on a domain controller will only replicate changes within the on-premises Active Directory environment. It will not trigger synchronization to Azure AD.
  To immediately replicate user information to Azure AD, you must use Azure AD Connect and run a delta synchronization cycle. This can be done either from the Azure AD Connect server or by using the PowerShell cmdlet `Start-ADSyncSyncCycle -PolicyType Delta`. This ensures that the changes in on-premises Active Directory are pushed to Azure AD.
  
  Why other options are incorrect:
  The option "Yes" is incorrect because Active Directory Sites and Services only handles replication within the on-premises Active Directory. It does not interact with or trigger Azure AD Connect to synchronize changes to Azure AD. Therefore, it will not meet the stated goal of replicating user information to Azure AD immediately.

  • Citations:
  • Azure AD Connect sync: Scheduler, https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/how-to-connect-sync-scheduler