Pass the Microsoft Azure Administrator Associate AZ-104 Questions and answers with Dumpstech

 B. NIC1 (Network Interface): Public IP addresses are directly associated with network interfaces. This allows the virtual machine connected to that interface to communicate with the internet.

 D. LB1 (Load Balancer): Load balancers can have a public IP address assigned to their frontend configuration. This allows external traffic to reach the load balancer, which then distributes it to the backend VMs.

Box 1 :  4

As there are 4 distinct set of resource types (Ingress, Egress, Delete storage account, Restore blob ranges), so you need 4 alert rules. In one alert rule you can ' t specify different type of resources to monitor. So you need 4 alert rules.

Box 2 : 3

There are 3 distinct set of " Users to notify " as (User 1 and User 3), (User1 only), and (User1, User2, and User3). You can ' t set the action group based on existing group (Group1 and  Group2) as there is no specific group for User1 only. So you need to create 3 action group.

The correct sequence of actions to configure a Point-to-Site (P2S) VPN connection are:

Create a VPN gateway: This is the core component that will handle the VPN connections. It needs to be deployed within VNet1.

Add an IP address pool: This pool defines the range of IP addresses that will be assigned to the VPN clients when they connect.

Create a local network gateway: This represents your on-premises network (in this case, the users ' home offices) and is necessary for the VPN gateway to establish a connection.

In Azure Role-Based Access Control (RBAC), the Storage Account Key Operator Service Role allows a user to list and regenerate access keys for a storage account but does not grant permission to access the data itself.

The Storage Account Key Operator Service Role has the following key permissions:

Microsoft.Storage/storageAccounts/listkeys/action

Microsoft.Storage/storageAccounts/regeneratekey/action

Microsoft.Storage/storageAccounts/read

This role is typically used by automation or service accounts that need to manage storage account keys without having full access to the data stored within the account (blobs, files, queues, etc.).

In the scenario, User1 only needs to list and regenerate storage account keys for storage1, not perform data operations or modify configurations. The Storage Account Key Operator Service Role provides precisely these permissions, making it the correct and minimal-privilege choice for this task.

Thus, assigning this role to User1 meets the goal as per Azure RBAC guidelines and Microsoft’s least privilege principle documented in the Azure Administrator exam guide.

Box 1: 5

A public and a private IP address can be assigned to a single network interface.

Box 2: 1

You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose.

In this scenario, you are troubleshooting inbound network traffic to VM2 where connections from the public IP 131.107.100.50 over TCP port 443 are failing, despite the Azure Load Balancer configuration being correct. The issue lies in the Network Security Group (NSG) rules applied to VM2-NIC1.

Understanding NSG Rule Processing

According to Microsoft Azure Administrator documentation (AZ-104 Study Guide, “Secure network traffic” section):

“Network security group rules are processed in priority order, from the lowest number to the highest number. As soon as a rule matches the traffic, rule processing stops.”

This means that once a matching rule is found (based on source, destination, port, and protocol), Azure will not evaluate further rules.

Analysis of the Exhibit

From the NSG configuration shown:

Priority

Name

Port

Protocol

Source

Destination

Action

100

Allow_131.107.100.50

443

TCP

131.107.100.50

VirtualNetwork

Allow

200

Block_All_Other443

443

TCP

Any

Any

Deny

65000

AllowVNetInBound

Any

Any

VirtualNetwork

VirtualNetwork

Allow

65001

AllowAzureLoadBalancerInBound

Any

Any

AzureLoadBalancer

Any

Allow

65500

DenyAllInBound

Any

Any

Any

Any

Deny

At first glance, Rule 100 should allow traffic from 131.107.100.50 on port 443, but it specifies Destination: VirtualNetwork, which applies only if the destination IP is part of the same virtual network (VNet).

However, in this case, the traffic originates from an external public IP address (131.107.100.50) trying to reach VM2 through the Azure Load Balancer, not directly through the virtual network.

Because of this, the destination does not match the “VirtualNetwork” scope, and the rule is effectively skipped. The next applicable rule (priority 200) explicitly denies all traffic on port 443. Therefore, the connection fails.

Proposed Solution: Modify the Priority

The question’s solution proposes modifying the priority of the Allow_131.107.100.50 rule.

If you adjust the rule’s priority and ensure that it is processed before the “Block_All_Other443” deny rule (priority 200) and correct its destination to Any, then the traffic from 131.107.100.50 will be evaluated first and allowed before the deny rule triggers.

Hence, by modifying the priority or adjusting the target scope, the traffic will successfully match the allow rule.

Official Documentation Reference

From Microsoft Learn – Network Security Groups Overview:

“Rules are processed in priority order. Once a rule matches the traffic, processing stops.”

“If you have a rule that denies specific traffic with a higher priority, any allow rules with a lower priority won’t be processed.”

Conclusion

By modifying the priority of the Allow_131.107.100.50 rule (or ensuring it appears before the deny rule in evaluation order), inbound traffic from that specific IP over port 443 will be allowed before the deny rule applies.

Therefore, the proposed solution meets the goal.

✅ Final Verified Answer: A. Yes

Modifying the priority of the “Allow_131.107.100.50” rule ensures it is processed before the “Block_All_Other443” deny rule, allowing the required inbound traffic to reach the VM successfully.

Comprehensive and Detailed 150 to 250 words of Explanation From [Microsoft Azure Administrator/Course Guide/topics]:

To enable SSPR for only User1 while keeping it disabled for User2, the correct first action is to create a Microsoft Entra group and place User1 in that group. Microsoft Entra ID supports enabling SSPR for None , Selected , or All users. When Selected is used, SSPR is enabled by choosing a Microsoft Entra group; Microsoft’s configuration flow explicitly states to select Selected , then browse for and select the Microsoft Entra group that contains the users enabled for SSPR.

Therefore, a group is required before targeted SSPR enablement can be applied. Authentication methods policies define which methods users can use, such as phone, email, or authenticator app, but they do not by themselves scope SSPR to only User1. Authentication context is used with Conditional Access, not SSPR targeting. Security defaults are tenant-wide baseline protections and are not the first step for enabling SSPR for one selected user. This maps directly to the AZ-104 study guide objective Manage Microsoft Entra users and groups , specifically Create users and groups and Configure self-service password reset (SSPR) .