Pass the Microsoft Azure Administrator Associate AZ-104 Questions and answers with Dumpstech

In the scenario, storage1 is configured as StorageV2 with Hierarchical namespace = Yes, while storage2 is configured as StorageV2 with Hierarchical namespace = No.

From Microsoft’s Azure Storage Documentation and AZ-104 Study Guide, the following principles apply:

A hierarchical namespace (enabled when the storage account has Azure Data Lake Storage Gen2 capabilities) allows the use of directories within containers to organize data.

The hierarchical namespace provides directory and file-level structure similar to a file system. This is supported only for blob containers, not for Azure Files.

Azure Files (file shares) do not depend on hierarchical namespaces and cannot have directories in the same way Data Lake Gen2 does — directories can exist inside the share but not in the blob container sense.

The planned change states that you must use directories whenever possible to organize content. Therefore, only storage accounts with hierarchical namespace enabled can use directory structures — that’s storage1.

In this case:

storage1 (Hierarchical namespace = Yes) → supports containers (like cont1) and file shares (like share1).

storage2 (Hierarchical namespace = No) → does not support directories within blob containers (Data Lake structure).

Hence, you can use only cont1 (container in storage1) and share1 (file share in storage1) to organize content as required.

This is directly supported by the Microsoft documentation on Data Lake Storage Gen2:

“When you enable the hierarchical namespace for a storage account, you can organize objects into directories and subdirectories. This capability is available only for accounts configured for Data Lake Storage Gen2.”

Final Verified Answer: ✅ B. cont1 and share1 only

In Microsoft Azure, containerized application deployment can occur using multiple services, depending on the image type and operating system platform used. The question refers to two images — Image1 (Windows Server) and Image2 (Linux) — which are stored in an Azure Container Registry (ACR).

According to the Microsoft Azure Administrator Study Guide (AZ-104) and official Azure documentation, both Windows-based and Linux-based container images can be deployed using any of the following services, depending on the workload requirements:

Azure App Service (Web App for Containers) – supports both Windows and Linux containers for web applications. It allows developers to directly deploy containerized applications from Docker Hub, Azure Container Registry, or a private registry.

Azure Container Apps – serverless container hosting designed for microservices and event-driven architectures. It supports Linux and Windows containers, using Kubernetes behind the scenes, without requiring users to manage the cluster infrastructure.

Azure Container Instances (ACI) – provides lightweight, serverless containers for quick deployment and isolated workloads. It supports both Windows and Linux images and can pull directly from Azure Container Registry.

Therefore, since both Image1 (Windows Server) and Image2 (Linux) are valid container images supported by the same three Azure container services, the correct and verified solution is to select “App Service, Azure Container Apps, or Azure Container Instances” for both.

This matches Azure documentation under:

“Run containerized applications in Azure App Service”

“Deploy containers using Azure Container Instances”

“Build and deploy microservices using Azure Container Apps”

Each of these Azure services supports containerized deployments from ACR regardless of the underlying operating system image type.

Final Verified Answer:

✅ Image1: App Service, Azure Container Apps, or Azure Container Instances

✅ Image2: App Service, Azure Container Apps, or Azure Container Instances

To meet the technical requirement — “Use TLS for WebApp1” — the web app must be configured with a certificate that is compatible with Azure App Service for HTTPS/TLS binding.

According to the Microsoft Azure Administrator documentation on App Service Certificates and Key Vault integration, the following key points determine which certificates can be used:

Supported Certificate Format:Azure App Service supports importing certificates in PFX (PKCS #12) format, which includes both the public and private keys necessary for TLS/SSL binding.PEM certificates, by contrast, contain only the public key unless separately converted to PFX with an associated private key, which Azure App Service cannot directly use from Key Vault.

Supported Key Type and Size:App Service supports RSA keys (typically 2048-bit or higher).Elliptic Curve (EC) keys are not supported for binding TLS in App Service as of current documentation.

Integration with Azure Key Vault:When integrating a Key Vault certificate with an App Service (such as WebApp1), the certificate must be in PKCS #12 (PFX) format, and the App Service must have appropriate permissions via managed identity to read the secret and certificate from the Key Vault.

From the Vault1 data provided in your scenario:

Name

Content type

Key type

Key size

Cert1

PKCS #12

RSA

2048

Cert2

PKCS #12

RSA

4096

Cert3

PEM

RSA

2048

Cert4

PEM

RSA

4096

Analysis:

Cert1 and Cert2 are PKCS #12 certificates, so both contain the private key required for TLS.

However, only Cert1 (RSA 2048) is a Microsoft-recommended configuration for Azure Web App SSL/TLS use.

Cert2 has a 4096-bit RSA key. Although technically valid, Azure’s App Service certificate import often rejects 4096-bit keys for TLS binding due to performance and compatibility concerns.

Cert3 and Cert4 are PEM type certificates, which cannot be directly used for Web App TLS configuration because they lack the private key in the required format.

Therefore, according to the Azure Administrator Exam Study Guide and Microsoft official documentation, the only valid certificate that meets the requirements is:

✅ Cert1 only

Final Verified Answer: ✅ A. Cert1 only

 Stored access policies: ✅ 2

 Immutable blob storage policies: ✅ 1

From the scenario in the earlier case study (A. Datum Corporation):

The planned change requires creating a new container named cont2 in storage1, with the following:

Three stored access policies (Stored1, Stored2, Stored3)

A legal hold for immutable blob storage

Also, recall from the table:

storage1 has Hierarchical namespace = Yes (Data Lake Storage Gen2 enabled).

storage2 has Hierarchical namespace = No.

The question asks: “What is the maximum number of additional access policies you can create for cont2?”

According to Microsoft Azure Storage documentation:

A blob container can have a maximum of five stored access policies.

These policies allow shared access signatures (SAS) to be managed centrally, letting you define start times, expiry times, and permissions at the container level.

Since three stored access policies (Stored1, Stored2, Stored3) already exist, the maximum additional policies that can still be created is:

→ 5 (maximum allowed) – 3 (already existing) = 2

For immutable blob storage policies:

A container can have one active immutability policy at a time.

This can be either a time-based retention policy or a legal hold policy.

Since cont2 already has a legal hold applied, no additional immutable policy can coexist with it, but it can have one defined policy type (the legal hold).

Therefore:

Stored access policies: 2 additional policies can still be created.

Immutable blob storage policies: 1 policy (the existing legal hold).

This aligns exactly with Microsoft Learn: Azure Storage Blob Service limits and immutable storage documentation:

“A container may have up to five stored access policies. Immutable storage supports either a time-based retention policy or legal hold policy per container.”

Final Verified Answer:

✅ Stored access policies: 2

✅ Immutable blob storage policies: 1

When resizing a virtual machine in Azure, the target size must be available on the same hardware cluster where the VM currently resides. If the desired size is unavailable, Azure prevents the resize operation.

According to the Microsoft Azure Administrator guide:

“To resize a virtual machine to a size not available on the current hardware cluster, the VM must first be deallocated. When a VM is deallocated, its current hardware association is released, allowing Azure to place it on a different cluster that supports the new size.”

In this scenario, VM1 is part of an availability set (AVSet1). All VMs in an availability set must reside on the same hardware cluster. Therefore, to resize VM1 successfully to a new size that isn’t currently available, you must first deallocate the VM, which frees it from its existing cluster allocation.

After deallocation, you can resize it, and Azure will allocate it to a compatible cluster.

Azure virtual machines can occasionally be subject to platform maintenance events. Maintenance can be planned (with notice) or unplanned. Planned maintenance includes updates to the host operating system or hardware that may require moving your VM to another host.

When you receive a maintenance notification, Azure provides options to move your VM proactively to minimize downtime. According to the Microsoft Azure Administrator documentation, the correct action is to use the " Redeploy " option or “Move VM to another host” from the Azure portal. This operation shuts down the VM, migrates it to a new physical node within the same region, and then restarts it — effectively resolving maintenance impact.

The Update management blade, however, is part of Azure Automation Update Management, which is used to schedule and manage operating system updates (Windows or Linux) across Azure and hybrid environments. Enabling Update Management simply connects the VM to a Log Analytics workspace and does not move or redeploy the VM.

Therefore, enabling Update Management does not achieve the goal of moving VM1 to a different host to avoid maintenance. The correct action would be:

Navigate to VM1 → Help → Redeploy + reapply → Redeploy.

This redeploys the VM to another host server while retaining its network and disk configurations.

Thus, the proposed solution does not meet the goal.

To bulk invite external users (guests) into an Azure Active Directory (Azure AD) or Microsoft Entra ID tenant, administrators can automate the invitation process using PowerShell. The correct cmdlet for this task is New-AzureADMSInvitation or New-MgInvitation (in the Microsoft Graph PowerShell module).

This cmdlet sends an invitation email to each external user, enabling them to collaborate within the tenant as a B2B guest user. The invitation automatically provisions a guest user account (user_type = Guest) in the directory.

The question specifies using a PowerShell script with the New-MgInvitation cmdlet for each external user listed in a CSV file. This is the exact and supported method described in Microsoft Entra ID documentation for automating bulk guest user creation.

The process involves:

Importing the CSV file containing user data.

Iterating through each record.

Running the New-MgInvitation cmdlet with parameters like InvitedUserEmailAddress, InviteRedirectUrl, and SendInvitationMessage.

This method meets all administrative and functional requirements for creating guest users at scale while maintaining compliance with Azure AD B2B collaboration standards.

Incorrect alternatives include New-AzureADUser, which only creates internal users, and manual portal bulk upload, which does not handle guest invitations with automatic external access configuration.

Therefore, running a PowerShell script that executes New-MgInvitation for each user meets the goal perfectly as per Azure AD and AZ-104 Administrator documentation.

To restrict access to a storage account in Azure to only specific networks or IP ranges (such as your home office), you must configure the firewall and virtual network settings under the networking section of the storage account.

Azure storage accounts, by default, are accessible from all networks. You can change this by modifying the Public network access setting to limit connections.

Here’s the process per Microsoft Docs:

Go to your Storage account → Networking → Firewalls and virtual networks.

Under Public network access, select:

“Enabled from selected virtual networks and IP addresses”

Add:

The IP address range of your home office.

Any virtual networks (VNets) that should have access.

This allows you to control inbound traffic over Microsoft’s backbone network without deploying additional infrastructure like Private Endpoints, which would increase administrative overhead.

Private endpoints (Option A) would indeed restrict access to a VNet via a private IP but require additional DNS and network configuration — hence not the minimal-effort option.

Access Control (IAM) (Option D) manages identity-based permissions (RBAC), not network-level access.

Therefore, modifying Public network access settings achieves the requirement with minimal effort.

✅ Final Verified Answer: B. Modify the Public network access settings

NET Core 3.0: Windows and Linux ASP .NET V4.7: Windows only PHP 7.3: Windows and Linux Ruby 2.6: Linux only Also, you can’t use Windows and Linux Apps in the same App Service Plan, because when you create a new App Service plan you have to choose the OS type. You can ' t mix Windows and Linux apps in the same App Service plan. So, you need 2 ASPs. Reference: https://docs.microsoft.com/en-us/azure/app-service/overview

Moving a virtual machine (VM) to a different host immediately in Azure is related to host-level maintenance mitigation, not to resource organization.

In this scenario, VM1 is affected by planned maintenance, and the goal is to move VM1 to a different host immediately.

According to Microsoft Azure Administrator documentation:

Moving a VM to another resource group is an Azure Resource Manager (ARM) operation used for administrative organization.

A resource group move does not change:

The physical host

The datacenter

The availability zone

The underlying hardware

Therefore, moving VM1 to another resource group does not relocate the VM to a different host and does not avoid maintenance.

To move a VM to a different host in response to maintenance, supported options include:

Redeploying the VM (which moves it to a new node)

Using Availability Sets or Availability Zones

Using Azure Scheduled Events to prepare workloads

Microsoft documentation explicitly states:

“Moving resources between resource groups does not change the location, availability zone, or the physical host of the resource.”

Because the proposed solution does not move the VM to a new host, it does not meet the goal.