Pass the Microsoft Azure Administrator Associate AZ-104 Questions and answers with Dumpstech

In Azure Container Registry (ACR), the admin user account provides a simple authentication mechanism using a username and password. Enabling the admin account and retrieving its credentials is done exclusively through the Access keys blade.

According to Azure Container Registry documentation:

The admin user is enabled/disabled from Access keys

The passwords (primary and secondary) are displayed and regenerated there

Other blades such as Networking, Properties, or Identity do not manage admin credentials

Final Answer:

D. Access keys

https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-firewall Azure Firewall is a cloud-based network security service that protects your Azure Virtual Network resources. Azure Firewall requires at least one public static IP address to be configured. This IP or set of IPs are used as the external connection point to the firewall. Azure Firewall supports standard SKU public IP addresses. Basic SKU public IP address and public IP prefixes aren 't supported.

SMB Multichannel is a feature of Azure Files that enables clients to establish multiple network connections to an Azure file share simultaneously. This allows parallel data transfer, thereby increasing throughput and providing fault tolerance for high-performance workloads.

According to the Microsoft Azure Administrator documentation and Azure Files technical reference, SMB Multichannel is available only for premium file shares hosted on Azure Files Premium Storage accounts that use locally redundant storage (LRS) replication.

Extract from Microsoft documentation:

“SMB Multichannel is supported only for premium file shares. Premium file shares are hosted in FileStorage storage accounts, which use SSD-based performance and locally redundant storage (LRS). Standard (HDD-based) file shares do not support SMB Multichannel.”

The Premium tier uses SSD storage, designed for low latency and high IOPS workloads, and is required for enabling SMB Multichannel. Using LRS (Locally Redundant Storage) provides the lowest cost redundancy option while still ensuring three replicas within the same datacenter.

Therefore, to meet the requirement of SMB Multichannel while minimizing costs, you must choose Premium performance with LRS redundancy.

<✅ Properties

✅ Authentication methods

Self-service password reset (SSPR) in Microsoft Entra ID (formerly Azure Active Directory) is configured from the Password reset blade in the Azure portal. Microsoft Entra ID P1 includes full support for SSPR for cloud users, including the ability to configure registration and authentication requirements.

To enable SSPR for all users, Microsoft documentation specifies that administrators must configure the Properties setting. From the Password reset → Properties page, you select who can use SSPR. The available options are None, Selected, or All. Setting this option to All enables self-service password reset for every user in the tenant. This setting controls who is allowed to use SSPR, not how they authenticate.

To require users to answer four questions when registering for SSPR, Microsoft Entra ID uses the Authentication methods setting. According to the Azure Administrator study guide, this section allows administrators to define:

Which authentication methods are available (email, mobile app, phone, security questions)

How many methods are required to reset a password

How many security questions users must answer during registration

Under Authentication methods → Security questions, you can configure the number of questions required for registration and number required to reset, including setting the registration requirement to four questions, exactly matching the scenario.

Other options shown in the blade (such as Administrator Policy or Usage & insights) do not control user enablement or question requirements and therefore do not meet the stated goals.

Box-1 : 3

Initial starts 2 VM's 15 minutes have passed. at 10 minutes 1 VM was added we now have 3 VM's. Cool down is 5 Minutes before another 10 minute wait cycle starts so the answer is 3.

Box-2: 1

Initial 5 VM's 60 minutes Pass. 1 VM removed every 15 minute cycle. 10 minutes wait timer plus 5 minute cool down equals 15 minutes cycle. Four 15 minute cycles pass equaling 60 minutes removing 4 VM's. We have 1 VM left.

Default Scale in and Out Default Durations are 10 minutes with 5 minute cool down.

The default scale set settings in Azure are:

-Minimum number of instances 1

-Maximum number of instances 10

-Scale out CPU threshold (%) 75

-Duration in minutes10

-Number of instances to increase by 1

-Scale in CPU threshold (%) 25

-Number of instances to decrease by -1

https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-portal#create-a-rule-to-automatically-scale-in

In Azure, Network Security Groups (NSGs) control inbound and outbound traffic to network interfaces, subnets, and virtual machines. When NSGs block all outbound traffic, VMs cannot reach Azure services such as Azure Key Vault, Storage, or Azure SQL Database, unless exceptions are explicitly configured.

To allow virtual machines to access Vault1 (Azure Key Vault), the correct and most efficient configuration is to use an Azure service tag as the destination in the outbound rule.

Service tags are predefined identifiers that represent a group of IP address prefixes for specific Azure services.

Microsoft automatically manages the address prefixes included in each tag, reducing administrative overhead and maintenance.

The service tag for Azure Key Vault is:

AzureKeyVault

You can create an outbound rule in NSG1 with:

Destination: Service tag → AzureKeyVault

Port: 443 (HTTPS)

Action: Allow

This allows only secure traffic to Azure Key Vault, satisfying the principle of least privilege (since it limits access to only the necessary service) while also minimizing administrative effort (since the service tag updates automatically as Azure changes).

Using an application security group or IP address range would require additional configuration and maintenance, making them less efficient.

✅ Final Verified Answer: A. a service tag

In Microsoft Azure, Role-Based Access Control (RBAC) defines what actions users can perform on resources. The Contributor role is one of the built-in Azure roles that provides extensive permissions but excludes access management rights.

According to the Microsoft Azure Administrator documentation under “Built-in roles for Azure resources”, the Contributor role has the following definition:

“Grants full access to manage all Azure resources, including the ability to create and manage resources, but does not grant permission to assign roles or manage access rights.”

This means that a Contributor can perform any configuration or management task on a resource (such as starting, stopping, resizing, or modifying a virtual machine) but cannot grant or modify permissions for other users.

Let’s analyze each option in this context:

A. Add a data disk — ✅ Correct

A Contributor can attach, detach, or manage data disks for the VM.

These actions involve resource management operations under the Microsoft.Compute/virtualMachines namespace, which are permitted to the Contributor role.

Microsoft Documentation Reference (Compute Resource Provider Operations):

Contributors can “create, update, and delete virtual machines, disks, and configurations.”

B. Configure a daily backup — ❌ Incorrect

Configuring a daily backup requires permissions within the Recovery Services vault or Backup vault resource type (Microsoft.RecoveryServices/vaults/*).

The Contributor role on the VM does not automatically grant access to vault-level resources.

Hence, User1 cannot configure or schedule a daily backup without additional permissions on the vault.

C. Assign User2 the Contributor role for VM1 — ❌ Incorrect

Assigning or modifying RBAC roles requires the Owner or User Access Administrator role because it involves operations under the Microsoft.Authorization/roleAssignments/* permission.

The Contributor role does not include these permissions.

Therefore, User1 cannot assign roles to others.

D. Upload an image of VM1 to an Azure compute gallery — ✅ Correct

The Contributor can capture or generalize a VM and upload its image to an Azure Compute Gallery, as this operation falls under the VM and image management permissions (Microsoft.Compute/galleries/images/*).

This action is considered a resource management operation and does not require ownership or RBAC rights beyond Contributor.

E. Assign User2 the Reader role for VM1 — ❌ Incorrect

Similar to option C, assigning RBAC roles is a management operation restricted to users with Owner or User Access Administrator privileges.

Contributors cannot modify or assign access control permissions.

Virtual Network: You can connect con-env1 to VNet2 and VNet3 only. This is because VNet1 is in a different region than the container app, which is East US. According to the web search results, you can only connect a container app environment to a virtual network that is in the same region as the container app1. Therefore, VNet1 is not a valid option. VNet2 and VNet3 are both in the same region as the container app, and they have enough available IP addresses to support a container app environment.

Subnet mask: You should use /28 as the subnet mask for con-env1. This is because /28 is the smallest possible subnet mask that can accommodate a container app environment. According to the web search results, a container app environment requires a minimum of 16 IP addresses in a subnet2. A /28 subnet mask provides 16 IP addresses, while a /26 subnet mask provides 64 IP addresses, a /24 subnet mask provides 256 IP addresses, a /23 subnet mask provides 512 IP addresses, and a /16 subnet mask provides 65,536 IP addresses. Therefore, /28 is the most efficient choice for minimizing the subnet size.

To ensure that the members of Group1 can upload files by using the Azure portal, they need to have both data access and management access to the storage account. Data access refers to the ability to read, write, or delete blob data in the storage account. Management access refers to the ability to view the storage account resources in the Azure portal, but not modify them. The Azure role-based access control (Azure RBAC) system provides built-in roles that encompass common sets of permissions for data access and management access. The Storage Blob Data Contributor role grants read, write, and delete access to blob data in the storage account. The Reader role grants view access to the storage account resources in the Azure portal. Therefore, by assigning both roles to Group1, the members of the group can upload files by using the Azure portal. This solution also follows the principle of least privilege, as the group members are only granted the minimum permissions required to perform the task. References:

Assign an Azure role for access to blob data

Data access from the Azure portal