Pass the Microsoft Azure Administrator Associate AZ-104 Questions and answers with Dumpstech

You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD).

Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up unused groups. Expiration policies can help remove inactive groups from the system and make things cleaner.

When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also deleted.

You can set up a rule for dynamic membership on security groups or Office 365 groups.

In Microsoft Azure Storage, maintaining high availability and durability of data is achieved through replication. There are multiple redundancy options — LRS (Locally Redundant Storage), ZRS (Zone-Redundant Storage), GRS (Geo-Redundant Storage), and RA-GRS (Read-Access Geo-Redundant Storage) — each serving different scenarios.

However, when the requirement is to create a secondary copy of blob data in a specific region (for example, when blob data is added in North Europe, a copy must be created in East US), geo-redundant storage (GRS) cannot be used directly because GRS replicates data automatically to a paired region, not to a region of your choice. In this case, North Europe’s paired region is West Europe, not East US. Therefore, GRS does not meet the goal.

The Microsoft Azure Administrator documentation specifies that the correct method for replicating data between user-defined regions is Object Replication for Block Blobs (OR).

Object replication allows you to:

Automatically replicate new and updated block blobs between two storage accounts in different Azure regions.

Use replication policies to define source and destination containers.

Minimize administrative effort, as once configured, replication occurs automatically and asynchronously.

Retain independent storage accounts, ensuring flexibility and control over access and lifecycle management.

Unlike lifecycle management rules (which only move or delete blobs within the same storage account) or operational backup (which protects data for restore purposes, not replication), object replication precisely meets the requirement of maintaining a secondary copy in another chosen region.

Therefore, per Azure’s official Storage replication and Object replication documentation, the correct configuration is Object replication between storage1 (North Europe) and another storage account in East US.

Azure provides resource locks to prevent accidental changes or deletion of critical resources. This is a core governance feature covered in the Microsoft Azure Administrator (AZ-104) study materials under resource management and protection.

To prevent administrators from inadvertently modifying resources in a resource group, you must apply a ReadOnly lock at the resource group scope. A ReadOnly lock allows users to view resources but blocks any modification or deletion, even for users with high privileges, unless the lock is first removed.

There are two primary lock levels in Azure:

ReadOnly – Users can read resources but cannot modify or delete them.

CanNotDelete (Delete) – Users can modify resources but cannot delete them.

Since the requirement is to prevent modification, the correct lock level is ReadOnly, not DeleteResources or CanNotDelete.

From Microsoft Azure Administrator documentation:

“A ReadOnly lock prevents users from making changes to a resource. Authorized users can still remove the lock if needed.”

To create this lock using PowerShell, the correct cmdlet is New-AzResourceLock, which is used to create management locks at the subscription, resource group, or resource level.

Applying the lock to RG1 ensures all resources within the group inherit the protection, meeting the requirement with minimal administrative effort.

Correct PowerShell Command (Conceptual Form)

New-AzResourceLock `

-LockName LockGroup `

-LockLevel ReadOnly `

-ResourceGroupName RG1

Final Hotspot Selections

Cmdlet: New-AzResourceLock

LockName: LockGroup

LockLevel: ReadOnly

ResourceGroupName: RG1

To create an inbound NAT rule, you need to specify a frontend IP address and a frontend port for the load balancer to receive the traffic, and a backend IP address and a backend port for the load balancer to forward the traffic to1. According to the first table, LB1 has only one frontend IP address, which is 40.121.183.105. However, this frontend IP address is already used by the existing inbound NAT rule named rule1, which forwards port 80 to VM1 on port 802. Therefore, you cannot use the same frontend IP address and port for another inbound NAT rule.

To solve this problem, you need to create a new frontend IP address for LB1 before you can create the new inbound NAT rules. You can do this by using the Azure portal, PowerShell, or CLI3. After you create a new frontend IP address, you can use it to create the new inbound NAT rules that meet your requirements.

1. Users can register applications → No

2. Restrict access to Microsoft Entra ID administration portal → Yes

In Microsoft Entra ID (formerly Azure Active Directory), the Default User Role Permissions setting determines what standard (non-admin) users can do in the directory by default. To meet the two stated requirements —

Prevent standard users from creating new service principals (applications), and

Restrict them to managing only their own Azure resources using PowerShell or Microsoft Graph —

you must modify the following two settings:

1. Users can register applications → No

When this setting is enabled, any user in the directory can register applications, which automatically creates service principals in Microsoft Entra ID. These service principals can be used to grant access to resources, effectively creating new security identities.

According to the official Microsoft Entra Administrator documentation:

“If you want to prevent non-administrators from creating app registrations or service principals in your organization, disable the ‘Users can register applications’ setting under Default User Role Permissions.”

By setting Users can register applications = No, you prevent standard users from creating new app registrations or service principals, fulfilling the first requirement.

2. Restrict access to Microsoft Entra ID administration portal → Yes

This setting determines whether standard users can access the Microsoft Entra admin center (portal.azure.com). When you enable Restrict access to Microsoft Entra ID administration portal, standard users can no longer access or modify directory-wide settings through the portal.

However, they can still manage their own Azure resources via PowerShell or Microsoft Graph (within their permissions).

As documented in Microsoft Learn (Manage default user permissions in Microsoft Entra ID):

“To ensure that users can only manage their own objects and resources, but not the directory configuration, enable ‘Restrict access to Microsoft Entra ID administration portal.’ This restriction does not prevent the use of PowerShell or Graph API for personal resources.”

This meets the second requirement that standard users can only use automation tools to manage their own Azure resources.

Summary of Correct Settings:

Setting

Correct Value

Reason

Users can register applications

No

Prevents creation of service principals by standard users.

Restrict access to Microsoft Entra ID administration portal

Yes

Ensures users only manage their own resources using PowerShell or Graph.

✅ Final Verified Answer:

1. Users can register applications → No

2. Restrict access to Microsoft Entra ID administration portal → Yes

To manage and interact with an Azure Kubernetes Service (AKS) cluster from your local computer, you must have the kubectl client installed. The kubectl command-line tool lets you run commands against Kubernetes clusters to deploy applications, inspect and manage cluster resources, and view logs.

Microsoft provides an official, recommended, and verified way to install kubectl using the Azure CLI.

✅ Correct Command Syntax:

az aks install-cli

???? Detailed Explanation:

1️⃣ Command Context (az)

The az prefix invokes the Azure Command-Line Interface (CLI), which is the unified tool for managing Azure resources directly from a local terminal or script environment.

2️⃣ Subcommand (aks)

The aks command group is used to manage Azure Kubernetes Service resources — including creating, configuring, scaling, and connecting to AKS clusters.

3️⃣ Action (install-cli)

The install-cli command downloads and installs the latest version of the kubectl binary compatible with your AKS cluster.

When you execute this command, Azure CLI:

Fetches the correct kubectl version that matches your AKS cluster.

Automatically places the binary in a directory included in your system’s PATH variable (or instructs you to do so manually).

Ensures version consistency between your management workstation and the AKS cluster.

⚙️ Alternative (Manual Installation):

While it’s possible to install kubectl manually (for example, via Install-Module in PowerShell or using msiexec.exe on Windows), Azure CLI’s az aks install-cli method is preferred because it automatically ensures version compatibility with the AKS cluster you are managing.

???? Microsoft Documentation Extract (Azure Administrator Study Guide Reference):

“To install kubectl using Azure CLI, use the command az aks install-cli. This method ensures the version of kubectl matches the version of Kubernetes used by your AKS cluster.”

(Source: Microsoft Learn — Manage Azure Kubernetes Service (AKS) with Azure CLI, Module: Deploy and Manage Compute Resources, AZ-104 Exam Guide.)

Azure role-based access control (Azure RBAC) for Azure file shares requires identity-based authentication integration. According to the Microsoft Azure Administrator documentation, this feature is only supported for StorageV2 (general purpose v2) and FileStorage account types.

In this scenario:

You are required to grant Group4 read-only access using Azure RBAC on Azure file shares.

The technical requirement specifies:

“Whenever possible, grant Group4 Azure RBAC read-only permissions to the Azure file shares.”

From the case study data:

Storage Account

Kind

Identity-based Access

storage1

Storage (general purpose v1)

Azure AD DS

storage2

StorageV2

Disabled

storage3

BlobStorage

N/A

storage4

FileStorage

Azure AD DS

The Storage (general purpose v1) type (storage1) does not support Azure AD or Azure RBAC integration for file shares. Microsoft documentation clearly states that “StorageV1 accounts must be upgraded to StorageV2 to support Azure AD authentication and RBAC role assignments.”

Meanwhile, FileStorage (storage4) already supports Azure AD Domain Services (Azure AD DS) and RBAC role assignment; hence no further modification is required there. However, to make storage1 compatible, it must be converted from StorageV1 to StorageV2.

Once converted to StorageV2, you can then:

Enable identity-based access for Azure file shares.

Assign Azure RBAC roles (e.g., Storage File Data Reader) to Group4.

Microsoft-Documented Requirements Summary:

Supported Account Types: StorageV2 or FileStorage

Unsupported: StorageV1 and BlobStorage

Required RBAC Roles for Read-Only Access:

Storage File Data Reader (or custom read-only role)

Thus, to meet the organization’s requirement to provide Azure RBAC read-only permissions, you must change the account type of storage1 to StorageV2, ensuring both storage1 and storage4 can be managed with Azure RBAC.

The question asks which storage account type should be created for storage5 and which existing storage account should be configured as the destination for replication — while supporting the planned changes.

Step 1: Planned Change Requirement

From the case study:

“Create a storage account named storage5 and configure storage replication for the Blob service.”

This indicates that storage5 will act as a secondary (destination) account to receive geo-replicated blobs (as part of RA-GRS or GRS replication configuration).

Therefore, the new storage5 must support Blob service replication features.

Step 2: Determining Correct Account Type

According to Microsoft Azure Administrator Documentation (Microsoft Learn: “Types of storage accounts”):

Account Type

Blob Support

File Share Support

Recommended Use

Storage (general purpose v1)

✅ Basic blob

Limited

Legacy use, lacks advanced features

StorageV2 (general purpose v2)

✅ Full blob, file, queue, table support

✅

Supports replication (GRS, RA-GRS, ZRS) and access tiers

BlobStorage

✅ Blob only

❌ No file shares

Used only for block and append blobs

BlockBlobStorage

✅ Blob only (premium tier)

❌ No file shares

High-performance workloads only

Therefore, the correct type for storage5 must be StorageV2, as it supports both:

Blob service replication (GRS, RA-GRS, ZRS, LRS)

All tiers (Hot, Cool, Archive)

This meets the planned change and ensures the account supports replication for Blob service.

Step 3: Determining the Correct Destination Storage Account

The question also requires identifying which existing storage account should act as the destination for replication configuration.

In Azure, Blob service replication (for example, geo-redundant replication or object replication) requires:

Both storage accounts to be StorageV2.

Both to be in the same region pair and have object replication enabled.

Looking at the table:

Storage Account

Kind

Location

File Share

Identity-based Access

storage1

Storage (general purpose v1)

West US

sharea

Azure AD DS

storage2

StorageV2 (general purpose v2)

East US

shareb, sharec

Disabled

storage3

BlobStorage

East US 2

N/A

N/A

storage4

FileStorage

Central US

shared

Azure AD DS

Only storage2 meets all of the following conditions:

✅ Type: StorageV2

✅ Region: East US (a valid replication pair for East US 2 or secondary region)

✅ Blob Service supported

Hence, storage2 is the correct destination storage account to configure for replication from storage5.

Step 4: Supporting Microsoft Azure Documentation Extracts

From Microsoft Learn – Azure Storage account overview:

“General-purpose v2 accounts support all Azure Storage features, including blob, file, queue, and table storage. They are recommended for most scenarios.”

“Object replication requires both source and destination accounts to be of the same type (StorageV2) and in regions that are geo-paired.”

“Blob and StorageV2 accounts support replication options such as LRS, ZRS, GRS, and RA-GRS.”

To meet the technical requirement that User1 can create initiative definitions and User4 can assign initiatives to RG2, we must understand how Azure Policy roles operate according to Microsoft Azure documentation and AZ-104 study guides.

Azure Policy uses role-based access control (RBAC) to determine who can create, manage, and assign policies or initiatives (policy sets). The key roles relevant to this task are:

Resource Policy Contributor – Allows users to create, edit, and delete policy definitions and initiative definitions, but does not allow assignment of policies or initiatives. This role is required for users who will design or build the policy logic (definitions).

Therefore, User1, who needs to create initiative definitions, must have the Resource Policy Contributor role.

Scope: Subscription (Sub1) – because initiatives are created at subscription or management group level.

Contributor – Provides full access to manage resources, except granting permissions. Contributors can assign existing policies or initiatives to resource groups or subscriptions if they have sufficient permissions.

Therefore, User4, who needs to assign initiatives to RG2, must be assigned the Contributor role at the RG2 scope.

Other roles:

Security Admin is related to Microsoft Defender for Cloud security settings, not policy creation.

Resource Policy Contributor for RG2 would not meet the requirement because creating definitions typically requires subscription-level access.

According to Microsoft Docs (“Azure built-in roles for Policy”):

“The Resource Policy Contributor role allows users to create, edit, and delete Azure policy and initiative definitions. To assign policies or initiatives, users need the Contributor or Owner role at the appropriate scope.”

Hence, the configuration should be:

User1: Resource Policy Contributor for Sub1

User4: Contributor for RG2