AZ-104 Microsoft Azure Administrator Free Practice Exam Questions (2026 Updated)

Box 1: IP flow verify

At some point, a VM may become unable to communicate with other resources, because of a security rule. The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which.

Box 2: Connection troubleshoot

Diagnose outbound connections from a VM: The connection troubleshoot capability enables you to test a connection between a VM and another VM, an FQDN, a

URI, or an IPv4 address. The test returns similar information returned when using the connection monitor capability, but tests the connection at a point in time, rather than monitoring it over time, as connection monitor does. Learn more about how to troubleshoot connections using connection-troubleshoot.

This question focuses on establishing a Remote Desktop (RDP) connection to a virtual machine (VM) through Azure Bastion using the native RDP client (mstsc.exe) from your local device.

Let’s break down each step according to Microsoft’s official Azure Bastion documentation.

Step 1: Upgrade Bastion1 to the Standard SKU

The Basic SKU of Azure Bastion supports only browser-based connections (via Azure Portal).

To use Native Client (RDP/SSH) support, you must use the Standard SKU.

The Standard SKU introduces advanced features like:

Native Client support (RDP/SSH via Azure CLI or PowerShell)

Kerberos Authentication

Custom port support

Scale-out for concurrent sessions.

✅ Therefore, before using the Azure CLI to initiate an RDP session, you must upgrade Bastion1 to the Standard SKU.

Step 2: From Bastion1, select Native Client Support

After upgrading to the Standard SKU, you must enable Native Client Support for Bastion1.

This option allows Azure Bastion to forward RDP/SSH connections using the native client (mstsc.exe) instead of the browser interface.

Once enabled, you can connect to the VM using your local Remote Desktop client over a secure Bastion connection.

✅ Enabling Native Client Support is mandatory before running Azure CLI commands to start the connection.

Step 3: From Azure CLI on Device1, run az network bastion rdp

Once Native Client Support is enabled, you can establish the RDP session directly using the Azure CLI command:

az network bastion rdp \

--name < BastionName > \

--resource-group < ResourceGroupName > \

--target-resource-id < VMResourceID >

This command launches the RDP client (mstsc.exe) locally on Device1 and securely tunnels the session through Bastion1 using Azure’s internal backbone network—no public IP needed.

✅ This is the final step that establishes the RDP connection from your local Windows 11 device to the Azure VM.

Incorrect Options Explained:

❌ From Bastion1, enable Kerberos authentication: Optional feature, not required for standard RDP access.

❌ From VM1, enable Just-in-Time (JIT) access: Used for security hardening in Defender for Cloud, not required for Bastion RDP.

❌ On Device1, run mstsc.exe: You don’t manually run mstsc.exe; the Azure CLI command automatically launches it.

✅ Final Verified Answer (in correct order):

Step

Action

1

Upgrade Bastion1 to the Standard SKU

2

From Bastion1, select Native Client Support

3

From Azure CLI on Device1, run az network bastion rdp

Microsoft Documentation Reference:

Microsoft Learn → Use Azure Bastion with a native client (RDP/SSH)

Microsoft Learn → Azure Bastion Standard SKU features overview

Microsoft Learn → Connect to a VM using Azure Bastion and Azure CLI

These documents confirm that Native Client support is only available in Azure Bastion Standard SKU, and the az network bastion rdp command is used to launch the RDP session via the native client.

Azure App Service Plans determine the scaling behavior of web apps hosted on them. Scaling can be done manually or automatically depending on the pricing tier.

From the Microsoft Azure Administrator Study Guide and official documentation (“Scale instance count manually or automatically” — Microsoft Learn):

“To enable automatic scaling based on metrics such as CPU usage, memory percentage, or HTTP queue length, your App Service Plan must be in the Standard, Premium, PremiumV2, or higher tier. You can then configure Scale Out (App Service plan) to use a Rules-Based method with performance thresholds.”

Available Scaling Options:

Manual: Fixed number of instances; no automatic scaling.

Automatic (Rules-Based): Create scaling rules based on metrics such as CPU > 80%, memory, or HTTP requests.

Scale Up (App Service Plan): Change pricing tier or hardware resources — does not provide auto-scaling.

In this scenario:

You already have a Standard plan (Plan1).

The requirement is to automatically scale out when CPU > 80%.

This behavior is achieved via Rules-Based scale-out, where you define a rule:

Metric: CPU Percentage

Condition: Greater than 80%

Action: Increase instance count

✅ Therefore, you must choose Rules Based in the Scale out method settings for Plan1.

When any internet user will try to access the cluster which is behind a load balancer, traffic will first hit to load balancer front end IP. So in the DNS configuration you have to provide the IP address of the load balancer.

1️⃣ VM1 is in the same availability set as VM2 → Yes

In Azure, for a Basic SKU Load Balancer, the backend virtual machines must be in the same availability set (or in the same virtual machine scale set).

Basic Load Balancers cannot span across multiple availability sets or availability zones.

The screenshot shows that LB1 uses the Basic SKU, so by requirement, VM1 and VM2 must be in the same availability set.

Therefore, this statement is true.

2️⃣ If Probe1.htm is present on VM1 and VM2, LB1 will balance traffic for TCP port 80 between VM1 and VM2 → Yes

A load balancing rule defines how traffic is distributed to the backend pool.

The rule “Rule1” uses TCP port 80 for both frontend and backend.

A health probe (Probe1.htm) monitors the health of backend VMs.

When both VMs respond successfully to Probe1.htm, the load balancer distributes TCP traffic on port 80 evenly between the two healthy VMs.

Therefore, when Probe1.htm is available and healthy on both VMs, LB1 distributes HTTP traffic (port 80) between VM1 and VM2.

This statement is true.

3️⃣ If you delete Rule1, LB1 will balance all the requests between VM1 and VM2 for all ports → No

Load balancers in Azure do not automatically balance traffic unless a load-balancing rule exists.

Each load balancing rule explicitly defines which ports and protocols are balanced.

If you delete Rule1, there will be no configuration telling the load balancer which ports to listen to or where to send traffic.

The load balancer will not distribute any traffic automatically for other ports.

Therefore, deleting the rule disables traffic distribution entirely, and this statement is false.

Microsoft Azure Administrator Official Documentation Extract (AZ-104 Reference):

“Basic Load Balancer can only balance traffic among VMs within a single availability set or virtual machine scale set.”

“A load-balancing rule defines how traffic is distributed to the backend pool. Deleting a rule stops load balancing for that port.”

“Health probes determine which backend pool instances receive new flows.”

(Source: Microsoft Learn — Azure Load Balancer Overview, Create and Manage Load Balancer Rules, Health Probes in Azure Load Balancer)

The correct answer is a Desired State Configuration (DSC) extension . Azure VM extensions are designed for post-deployment configuration and automation on Azure virtual machines, and Microsoft states that VM extensions can be managed by ARM templates, PowerShell, Azure CLI, and the Azure portal. Microsoft’s DSC extension documentation states that the Azure DSC extension uses the Azure VM Extension framework to deliver, enact, and report on DSC configurations running on Azure VMs.

Because the virtual machines are Windows Server instances deployed in a virtual machine scale set through an ARM template, the DSC extension is the correct mechanism to enforce a desired software configuration across all deployed instances. It can be included in the template so that each VM receives the required configuration after provisioning.

The New-AzConfigurationAssignment cmdlet relates to machine configuration assignments and is not the direct ARM-template VM extension mechanism for installing software during deployment. Azure Application Insights monitors application telemetry; it does not install NGINX. Microsoft Intune device configuration profiles manage enrolled devices, not Azure VMSS software installation in an ARM deployment. This maps to AZ-104 Deploy and manage Azure compute resources , specifically Deploy and configure Azure Virtual Machine Scale Sets and ARM template-based deployment.

Once the VNets are peered, all resources on one VNet can communicate with resources on the other peered VNets. You plan to enable peering between Paris-VNet and AllOffices-VNet. Therefore VMs on Subnet1, which is on Paris-VNet and VMs on Subnet3, which is on AllOffices-VNet will be able to connect to each other.

All Azure resources connected to a VNet have outbound connectivity to the Internet by default. Therefore VMs on ClientSubnet, which is on ClientResources-VNet will have access to the Internet; and VMs on Subnet3 and Subnet4, which are on AllOffices-VNet will have access to the Internet.

B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users ' Intranet zone settings by using Group Policy in Active Directory: https://autologon.microsoftazuread-sso.com

E: Seamless SSO works with any method of cloud authentication - Password Hash Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.

You can opt in and configure additional recipients to receive your Azure invoice in an email. This feature may not be available for certain subscriptions such as support offers, Enterprise Agreements, or Azure in Open.

Select your subscription from the Subscriptions page. Opt-in for each subscription you own. Click Invoices then Email my invoice.

Click Opt in and accept the terms.

Scenario: During the testing phase, auditors in the finance department must be able to review all Azure costs from the past week.

Explanation

Scenario:

1. Web administrators will deploy Azure web apps for the marketing department.

2. Each web app will be added to a separate resource group.

3. The initial configuration of the web apps will be identical.

4. The web administrators have permission to deploy web apps to resource groups.

Steps:

1 -- > Create a resource group, and then deploy a web app to the resource group.

2 -- > From the Automation script blade of the resource group , click Add to Library.

3 -- > From the Templates service, select the template, and then share the template to the web administrators .

Scenario: Licensing Issue

1. You attempt to assign a license in Azure to several users and receive the following error message: " Licenses not assigned. License agreement failed for one user. "

2. You verify that the Azure subscription has the available licenses.

Solution:

License cannot be assigned to a user without a usage location specified.

Some Microsoft services aren ' t available in all locations because of local laws and regulations. Before you can assign a license to a user, you must specify the Usage location property for the user. You can specify the location under the User  >  Profile  >  Settings section in the Azure portal.

IdFix is used to perform discovery and remediation of identity objects and their attributes in an on-premises Active Directory environment in preparation for migration to Azure Active Directory. IdFix is intended for the Active Directory administrators responsible for directory synchronization with Azure Active Directory.

Scenario: Active Directory Issue

Several users in humongousinsurance.com have UPNs that contain special characters.

You suspect that some of the characters are unsupported in Azure AD.

Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com.

The initial domain name cannot be changed or deleted, but you can add your corporate domain name to Azure AD as well. For example, your organization probably has other domain names used to do business and users who sign in using your corporate domain name. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as ‘alice@contoso.com.’ instead of ' alice@domain name.onmicrosoft.com ' .

Scenario:

Network Infrastructure: Each office has a local data center that contains all the servers for that office. Each office has a dedicated connection to the Internet.

Humongous Insurance has a single-domain Active Directory forest named humongousinsurance.com

Planned Azure AD Infrastructure: The on-premises Active Directory domain will be synchronized to Azure AD.

D: Seamless SSO works with any method of cloud authentication - Password Hash Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.

B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users ' Intranet zone settings by using Group Policy in Active Directory: https://autologon.microsoftazuread-sso.com

Statement 1: Yes

All client computers in the Paris office will be joined to an Azure AD domain.

A virtual network named Paris-VNet that will contain two subnets named Subnet1 and Subnet2.

Microsoft Windows Server Active Directory domains, can resolve DNS names between virtual networks. Automatic registration of virtual machines from a virtual network that ' s linked to a private zone with auto-registration enabled. Forward DNS resolution is supported across virtual networks that are linked to the private zone.

Statement 2: Yes

A virtual network named ClientResources-VNet that will contain one subnet named ClientSubnet You plan to create a private DNS zone named humongousinsurance.local and set the registration network to the ClientResources-VNet virtual network.

As this is a registration network so this will work.

Statement 3: No

Only VMs in the registration network, here the ClientResources-VNet, will be able to register hostname records. Since Subnet4 not connected to Client Resources Network thus not able to register its hostname with humongoinsurance.local

Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com. The initial domain name cannot be changed or deleted, but you can add your corporate domain name to Azure AD as well. For example, your organization probably has other domain names used to do business and users who sign in using your corporate domain name. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as ‘alice@contoso.com.’ instead of ' alice@domain name.onmicrosoft.com ' .

Scenario:

Network Infrastructure: Each office has a local data center that contains all the servers for that office. Each office has a dedicated connection to the Internet.

Humongous Insurance has a single-domain Active Directory forest named humongousinsurance.com

Planned Azure AD Infrastructure: The on-premises Active Directory domain will be synchronized to Azure AD.

Cost analysis: Correct Option

In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span:  last 7 days, last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.

Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range. Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn ' t bound to the calendar month, like the current billing period or last invoice. Use the  < PREVIOUS and NEXT >  links at the top of the menu to jump to the previous or next period, respectively. For example,  < PREVIOUS will switch from the Last 7 days to 8-14 days ago or 15-21 days ago.

Invoice: Incorrect Option

Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week ' s cost then that also not filled by invoices because Azure  generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty. Below is from Microsoft document:

Resource Provider: Incorrect Option

When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.

Payment method: Incorrect Option

Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.