Microsoft Azure AZ-104 Exam Questions 2025

Updated:
Reviews Demo Exam Description

Our AZ-104 Exam Questions provide authentic, up-to-date content for the Microsoft Certified: Azure Administrator Associate certification. Each question is reviewed by certified Azure professionals and includes verified answers with clear explanations to reinforce your skills in managing Azure identities, compute, networking, storage, and governance. With access to our exam simulator, you can practice under real exam conditions and confidently prepare to pass on your first attempt.

Exam Questions

Question 1

Your company has an Azure subscription named Subscription1. The company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named adatum.com. Adatum.com contains 1,000 DNS records. You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed: The DNS Manager console Azure PowerShell Azure CLI 2.0 You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution must minimize administrative effort. What should you use?
Options
A: Azure CLI
B: Azure PowerShell
C: the Azure portal
D: the DNS Manager console
Show Answer
Correct Answer:
Azure CLI
Explanation
The most efficient method to migrate a large DNS zone with 1,000 records from an on- premises server to Azure is by using the Azure CLI. The Azure CLI provides a specific command, az network dns zone import, which is designed to take a standard DNS zone file and automatically create all the corresponding records in an Azure DNS zone. This single- command operation significantly minimizes administrative effort compared to manually creating records or scripting the process.
Why Incorrect Options are Wrong

B. Azure PowerShell: While Azure PowerShell can manage Azure DNS, it lacks a single,

dedicated cmdlet for importing an entire zone file. Accomplishing this would require writing a

custom script to parse the file and create each record individually, which is more effort.

C. the Azure portal: Using the Azure portal would require manually creating each of the

1,000 DNS records. This is the most time-consuming and error-prone method, representing

the maximum administrative effort.

D. the DNS Manager console: This tool is used to manage on-premises Windows Server

DNS. It has no native capability to interact with or migrate zones directly to the Azure DNS

service.

References

1. Microsoft Azure Documentation, "Tutorial: Import and export a DNS zone file using the

Azure CLI": This official tutorial explicitly details the use of the az network dns zone import

command as the primary method for importing a zone file. It states, "This article explains

how to import and export a DNS zone file for Azure DNS by using the Azure CLI."

URL: https://learn.microsoft.com/en-us/azure/dns/dns-import-export

2. Microsoft Azure Documentation, "az network dns zone import": The reference for the

specific Azure CLI command confirms its purpose: "Create a DNS zone and records from a

local zone file." This directly addresses the requirement to move the zone with minimal

effort.

URL: https://learn.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-clilatest#az-network-dns-zone-import

3. Microsoft Azure Documentation, "New-AzDnsRecordSet": The documentation for the

comparable Azure PowerShell cmdlet shows it is designed to create individual record sets,

confirming that a bulk import requires additional scripting, unlike the Azure CLI's direct

import command.

URL: https://learn.microsoft.com/en-us/powershell/module/az.dns/new-azdnsrecordset

Question 2

You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2, and VM3. You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only. What should you configure?
Options
A: an inbound NAT rule
B: a new public load balancer for VM3
C: a frontend IP configuration
D: a load balancing rule
Show Answer
Correct Answer:
an inbound NAT rule
Explanation
An inbound NAT rule is the correct configuration for forwarding traffic from a specific port on the load balancer's public IP address to a specific virtual machine in the backend pool. The requirement is to direct all Remote Desktop Protocol (RDP) traffic, which uses a specific port (typically 3389), to a single, designated virtual machine (VM3). A load balancing rule, in contrast, distributes traffic across all available VMs in the backend pool, which is not the desired outcome.
Why Incorrect Options are Wrong

B. a new public load balancer for VM3: This is an inefficient and unnecessary solution. The

existing load balancer is capable of handling this requirement with the correct rule

configuration, avoiding additional cost and complexity.

C. a frontend IP configuration: This defines the public IP address for the load balancer.

While necessary for the load balancer to function, it does not define the rules for directing

traffic to backend resources.

D. a load balancing rule: A load balancing rule would distribute RDP connections across all

three virtual machines (VM1, VM2, and VM3), not direct them exclusively to VM3 as

required.

References

1. Microsoft Azure Documentation - What is Azure Load Balancer?: "An inbound NAT rule

forwards incoming traffic sent to the frontend IP address and port combination to a specific

virtual machine or instance in the backend pool. A load balancing rule distributes incoming

traffic across all instances within the backend pool."

URL: https://docs.microsoft.com/en-us/azure/load-balancer/load-balanceroverview#inbound-nat-rule

2. Microsoft Azure Documentation - Manage inbound NAT rules for Azure Load Balancer:

"Azure Load Balancer supports inbound network address translation (NAT) rules. You use

these rules to specify a backend resource to route traffic to from the load balancer

frontend."

URL: https://docs.microsoft.com/en-us/azure/load-balancer/manage-inbound-nat-rules

Question 3

HOTSPOT - You have an Azure subscription named Subscription1 that contains the virtual networks in the following table. Microsoft AZ-104 Exam Questions exam question Subscription1 contains the virtual machines in the following table. Microsoft AZ-104 Exam Questions exam question In Subscription1, you create a load balancer that has the following configurations: Name: LB1 SKU: Basic Type: Internal Subnet: Subnet12 Virtual network: VNET1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. Hot Area: Microsoft AZ-104 Exam Questions exam question
Show Answer
Correct Answer:
Explanation
The key to this question is understanding the backend pool limitations of the Basic SKU Azure Load Balancer. While all the virtual machines are within the same Virtual Network (VNet) as the load balancer (VNET1), the composition of the backend pool is restricted. 1. LB1 can balance the traffic between VM1 and VM2: Yes o VM1 and VM2 are in the same virtual network (VNET1) as the load balancer. o Both VM1 and VM2 are members of the same availability set (AS1). o A Basic Load Balancer's backend pool can be populated by all virtual machines within a single availability set. This is a valid configuration. 2. LB1 can balance the traffic between VM3 and VM4: No o VM3 and VM4 are standalone virtual machines, as they are not part of any availability set. o A significant limitation of the Basic Load Balancer is that its backend pool cannot contain more than one standalone virtual machine. Since balancing traffic between VM3 and VM4 would require adding both to the same backend pool, this configuration is not possible. 3. LB1 can balance the traffic between VM5 and VM6: No o Similar to the previous statement, VM5 and VM6 are standalone virtual machines. o Due to the Basic SKU limitation, a backend pool cannot be configured with two or more standalone virtual machines. Therefore, LB1 cannot balance traffic between VM5 and VM6.
References

•

Microsoft Azure Documentation - Load Balancer SKUs: This document

explicitly details the differences between Basic and Standard SKU load

balancers. In the feature comparison table, under "Backend pool," it specifies

that the Basic SKU backend pool is limited to a "single availability set, single

virtual machine scale set, or a single virtual machine." This confirms that

multiple standalone VMs are not supported in a single backend pool for the

Basic SKU.

o URL: https://docs.microsoft.com/en-us/azure/load-balancer/skus (Refer

to the "SKU comparison" section).

•

Microsoft Azure Documentation - Load Balancer Components: This page

details the components of a load balancer, including the backend pool. It

states, "For a Basic load balancer, the backend pool can't include more than

one virtual machine that isn't part of an availability set or a virtual machine

scale set."

o URL: https://learn.microsoft.com/en-us/azure/loadbalancer/components#backend-pools (Refer to the "Backend pools"

section).

Question 4

HOTSPOT - You have an Azure virtual machine that runs Windows Server 2019 and has the following configurations: Name: VM1 Location: West US Connected to: VNET1 Private IP address: 10.1.0.4 Public IP addresses: 52.186.85.63 DNS suffix in Windows Server: Adatum.com You create the Azure DNS zones shown in the following table. Microsoft AZ-104 Exam Questions exam question You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1 can automatically register. Which zones should you identify? To answer, select the appropriate options in the answer area. Hot Area: Microsoft AZ-104 Exam Questions exam question
Show Answer
Correct Answer:
Explanation
Only Azure Private DNS zones can be linked to a virtual network; public zones cannot. Any private zone”forward or reverse”can therefore be linked to VNET1. Automatic (dynamic) registration occurs only for private zones that are linked to the virtual network with registration enabled and whose names match either: 1. the VM DNS suffix (forward lookup), or 2. the appropriate reverse-lookup namespace for the VM™s IP address. VM1 DNS suffix is œadatum.com, so it auto-registers in the private œadatum.com zone. Its IP 10.1.0.4 falls into the 0.1.10.in-addr.arpa reverse zone, so a PTR record is also auto- registered there. contoso.com does not match the DNS suffix, so no auto-registration occurs in that zone.
References

1. Microsoft Azure Docs What is Azure Private DNS? (Functions: linking, auto-registration)

https://learn.microsoft.com/en-us/azure/dns/private-dns-overview#virtual-network-links

2. Microsoft Azure Docs Create a private DNS zone and link it to a virtual network (linking

rules, auto-registration option)

https://learn.microsoft.com/en-us/azure/dns/private-dns-getstarted-portal#link-a-virtualnetwork-to-the-private-zone

3. Microsoft Azure Docs Reverse DNS for Private DNS (automatic PTR registration)

https://learn.microsoft.com/en-us/azure/dns/private-dns-reverse-zones

Question 5

DRAG DROP - You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines connect to the virtual networks. The virtual networks have the address spaces and the subnets configured as shown in the following table. Microsoft AZ-104 Exam Questions exam question You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place: Microsoft AZ-104 Exam Questions exam question
Show Answer
Correct Answer:
Explanation
The NSG already contains an outbound rule (DenyWebSites) that denies TCP port 80. Because the NSG is presently attached only to a single NIC, VM2 is unaffected. Associating the NSG with Subnet1 makes every NIC in that subnet including those of VM1 and VM2 subject to the existing outbound-deny rule, preventing both VMs from reaching Internet web sites on port 80.
Why Incorrect Options are Wrong

A. Disassociating the NSG removes all its rules, permitting not blocking Internet access.

B. Inbound rules govern traffic entering the VM; they do not control outbound traffic to

websites.

D. The outbound deny rule already blocks port 80; no modification is required its scope

must simply include both VMs.

References

1. Microsoft Azure Documentation Network security groups overview, Associations section:

An NSG linked to a subnet applies to all network interfaces in that subnet.

https://learn.microsoft.com/azure/virtual-network/network-security-groupsoverview#associations

2. Microsoft Azure Documentation Security rules table: Outbound rules filter traffic leaving

the VM to the Internet on specified ports. https://learn.microsoft.com/azure/virtualnetwork/network-security-groups-overview#security-rules

Question 6

DRAG DROP - You have an on-premises network that you plan to connect to Azure by using a site-so-site VPN. In Azure, you have an Azure virtual network named VNet1 that uses an address space of 10.0.0.0/16 VNet1 contains a subnet named Subnet1 that uses an address space of 10.0.0.0/24. You need to create a site-to-site VPN to Azure. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choice is correct. You will receive credit for any of the correct orders you select. Select and Place: Microsoft AZ-104 Exam Questions exam question
Show Answer
Correct Answer:
Explanation
The NSG already contains an outbound rule (DenyWebSites) that denies TCP port 80. Because the NSG is presently attached only to a single NIC, VM2 is unaffected. Associating the NSG with Subnet1 makes every NIC in that subnet including those of VM1 and VM2 subject to the existing outbound-deny rule, preventing both VMs from reaching Internet web sites on port 80.
Why Incorrect Options are Wrong

A. Disassociating the NSG removes all its rules, permitting not blocking Internet access.

B. Inbound rules govern traffic entering the VM; they do not control outbound traffic to

websites.

D. The outbound deny rule already blocks port 80; no modification is required its scope

must simply include both VMs.

References

1. Microsoft Azure Documentation Network security groups overview, Associations section:

An NSG linked to a subnet applies to all network interfaces in that subnet.

https://learn.microsoft.com/azure/virtual-network/network-security-groupsoverview#associations

2. Microsoft Azure Documentation Security rules table: Outbound rules filter traffic leaving

the VM to the Internet on specified ports. https://learn.microsoft.com/azure/virtualnetwork/network-security-groups-overview#security-rules

Question 7

You have an Azure subscription that contains the resources in the following table. Microsoft AZ-104 Exam Questions exam question VM1 and VM2 are deployed from the same template and host line-of-business applications. You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.) Microsoft AZ-104 Exam Questions exam question You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80. What should you do?
Options
A: Disassociate the NSG from a network interface
B: Change the Port_80 inbound security rule.
C: Associate the NSG to Subnet1.
D: Change the DenyWebSites outbound security rule.
Show Answer
Correct Answer:
Associate the NSG to Subnet1.
Explanation
The NSG already contains an outbound rule (DenyWebSites) that denies TCP port 80. Because the NSG is presently attached only to a single NIC, VM2 is unaffected. Associating the NSG with Subnet1 makes every NIC in that subnet including those of VM1 and VM2 subject to the existing outbound-deny rule, preventing both VMs from reaching Internet web sites on port 80.
Why Incorrect Options are Wrong

A. Disassociating the NSG removes all its rules, permitting not blocking Internet access.

B. Inbound rules govern traffic entering the VM; they do not control outbound traffic to

websites.

D. The outbound deny rule already blocks port 80; no modification is required its scope

must simply include both VMs.

References

1. Microsoft Azure Documentation Network security groups overview, Associations section:

An NSG linked to a subnet applies to all network interfaces in that subnet.

https://learn.microsoft.com/azure/virtual-network/network-security-groupsoverview#associations

2. Microsoft Azure Documentation Security rules table: Outbound rules filter traffic leaving

the VM to the Internet on specified ports. https://learn.microsoft.com/azure/virtualnetwork/network-security-groups-overview#security-rules

Question 8

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first?
Options
A: Move VM1 to Subscription2.
B: Move VNet1 to Subscription2.
C: Modify the IP address space of VNet2.
D: Provision virtual network gateways.
Show Answer
Correct Answer:
Provision virtual network gateways.
Explanation
The two virtual networks (VNets) are in different subscriptions associated with different Azure AD tenants. Standard VNet peering cannot connect VNets across different tenants. Therefore, a VNet-to-VNet VPN gateway connection is required. The foundational and first step to establish this type of connection is to create a virtual network gateway in each VNet. The existing IP address spaces do not overlap, which is a prerequisite for this connection, so no changes are needed there.
Why Incorrect Options are Wrong

A. Move VM1 to Subscription2: Moving a virtual machine does not establish connectivity

between the virtual networks themselves.

B. Move VNet1 to Subscription2: This is a significant administrative change. The direct

method to connect the networks as they are is with gateways, not by moving resources

between tenants.

C. Modify the IP address space of VNet2: The IP address spaces (10.0.0.0/16 and

10.10.0.0/24) do not overlap, so modification is unnecessary.

References

1. Microsoft Azure Documentation - Configure a VNet-to-VNet VPN gateway connection by

using the Azure portal: This official guide outlines the procedure. The first major

configuration step after creating the VNets is to "Create the virtual network gateways."

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnetresource-manager-portal#create-the-virtual-network-gateways

2. Microsoft Azure Documentation - Virtual network peering: This document clarifies the

limitations of VNet peering, stating that while it can work across subscriptions, those

subscriptions must be associated with the same Azure Active Directory tenant. This

confirms peering is not an option in the given scenario.

URL: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peeringoverview#requirements-and-constraints

3. Microsoft Azure Documentation - About VNet-to-VNet VPN gateway connections: This

resource confirms that VNet-to-VNet connections are the appropriate solution for

connecting VNets in different subscriptions, which is necessary for cross-tenant scenarios.

URL: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vnet-to-vnet

Question 9

You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit. Microsoft AZ-104 Exam Questions exam question The planned disk configurations for VM1 are shown in the following exhibit. Microsoft AZ-104 Exam Questions exam question You need to ensure that VM1 can be created in an Availability Zone. Which two settings should you modify? Each correct answer presents part of the solution.
Options
A: Use managed disks
B: OS disk type
C: Availability options
D: Size
E: Image
Show Answer
Correct Answer:
Use managed disks, Availability options
Explanation
To deploy a virtual machine into an Azure Availability Zone, two fundamental configuration requirements must be met. First, the Availability options setting must be explicitly configured for zonal deployment; the current setting of "No infrastructure redundancy required" must be changed to "Availability zone". Second, virtual machines that use Availability Zones must use Azure Managed Disks. The exhibit shows the plan is to not use managed disks, which is incompatible with Availability Zones. Therefore, this setting must be enabled.
Why Incorrect Options are Wrong

B. OS disk type: The disk type (e.g., Standard HDD, Premium SSD) is not the constraint.

The requirement is that the disk must be managed, regardless of its performance tier.

D. Size: The StandardB2s VM size supports Availability Zones in regions where zones are

available. This setting is not the primary configuration that needs to be changed.

E. Image: Standard Azure Marketplace images, such as Windows Server 2016 Datacenter,

are fully compatible with deployment into an Availability Zone.

References

1. Microsoft Azure Documentation - Create a virtual machine in an availability zone using

the Azure portal: "To use availability zones, your VM must be created in a supported Azure

region. ... VMs must use Azure managed disks to be placed in an availability zone." This

source confirms that both the availability option must be set and managed disks must be

used.

URL: https://learn.microsoft.com/en-us/azure/virtual-machines/create-portal-availabilityzone

2. Microsoft Azure Documentation - Availability options for Azure Virtual Machines:

"Availability zones... To protect your applications from datacenter-level failures, you can

create a virtual machine in an availability zone." This highlights that the "Availability options"

setting is the direct control for this feature.

URL: https://learn.microsoft.com/en-us/azure/virtual-machines/availability

3. Microsoft Azure Documentation - Introduction to Azure managed disks: "Azure managed

disks are required for... Availability zones." This document explicitly states the dependency

on managed disks for the Availability Zone feature.

URL: https://learn.microsoft.com/en-us/azure/virtual-machines/managed-disksoverview#availability-zones

Question 10

HOTSPOT - You have an Azure subscription that contains the resources shown in the following table. Microsoft AZ-104 Exam Questions exam question VMSS1 is set to VM (virtual machines) orchestration mode. You need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1. Which resource group and location should you use to deploy VM1? To answer, select the appropriate options in the answer area. Microsoft AZ-104 Exam Questions exam question Hot Area:
Show Answer
Correct Answer:
Explanation
A virtual machine can be added to a scale set that is in VM (flexible) orchestration mode only when the VM resides in the identical subscription, region, resource group, and virtual network as the scale set. Therefore, VM1 must be deployed to the resource group and region where VMSS1 already exists RG1 in East US before it can be attached to VMSS1.
References

1. Microsoft Learn Add an existing VM to a flexible scale set

https://learn.microsoft.com/azure/virtual-machine-scale-sets/flexible-guestvms#prerequisites

(The VM you add must be in the same subscription, resource group, region, and virtual

network as the scale set.)

Unlock All 60 Questions

Sale!
microsoft-az-104 exam questions
Total Questions569
Last Update Check September 24, 2025
Online Simulator PDF Downloads
50,000+ Students Helped So Far
$30.00 $60.00 50% off
Rated 5 out of 5
 5.0 (46 reviews)

Instant Download & Simulator Access

Secure SSL Encrypted Checkout

100% Money Back Guarantee

What Users Are Saying:

Rated 5 out of 5

“The practice questions were spot on. Felt like I had already seen half the exam. Passed on my first try!”

Sarah J. (Verified Buyer)

Download Free Demo PDF Free AZ-104 Practice Test
CertEmpire White Footer Logo - Trusted Exam Dumps Provider

CERTEMPIRE is your one-stop shop to access IT Certification Exam Dumps. We have helped thousands of people achieve their dreams of becoming certified in their desired certifications through exam dumps that surely appear in exams. We can help you achieve your goals too.

Contact Us

[email protected]

Helpful links

Top Exams

Popular Exams

Copyright © 2025 Cert Empire.
Shopping Cart
Scroll to Top

FLASH OFFER

Days
Hours
Minutes
Seconds

avail $6 DISCOUNT on YOUR PURCHASE

  • USE THE CODE GIVEN BELOW ON YOUR CHECKOUT
OFFME6