Quiz AZ-104: Microsoft Azure Administrator

Correct Answer: Azure Traffic Manager
Azure Traffic Manager is a DNS-based traffic load balancer that distributes traffic across multiple endpoints
(such as Azure App Service, VMs, or services in different regions) based on routing methods like performance,
geographic, or priority. It automatically redirects traffic away from unhealthy endpoints, making it ideal for
multi-region disaster recovery scenarios where you need geographic load balancing and health-based failover.
Why the other options are incorrect:
l Azure Load Balancer: Provides layer 4 (transport) load balancing within a single region or availability zone.
It does not provide geographic routing or cross-region traffic distribution.
l Azure Application Gateway: Works at layer 7 (application) and is designed for routing within a region or
across a small number of backends, not for global multi-region failover patterns.
l Azure Front Door: While it does provide global load balancing and routing, it is typically used for web
applications and content delivery at the edge, whereas Traffic Manager is the standard choice for general
multi-region endpoint failover.

Correct Answer: Azure role-based access control (RBAC) with a time-limited assignment using
privileged identity management (PIM)
Privileged Identity Management (PIM) allows you to create time-bound role assignments that automatically
expire after a specified duration. You can assign contractors a specific Azure RBAC role (such as Contributor) on
a resource group with an expiration date of three months, and the access will be revoked automatically without
requiring manual intervention.
Why the other options are incorrect:
l Permanent role assignment with a scheduled deletion reminder: This requires manual action to
remove the assignment and relies on someone remembering to do so. It does not provide automatic
expiration.
l Azure resource locks combined with access reviews: Resource locks prevent accidental deletion or
modification but do not control access permissions. Access reviews help audit access but do not automatically
expire role assignments.
l Management groups with conditional access policies: Management groups are for organizing
subscriptions hierarchically, and conditional access is primarily for authentication conditions (device state,
location, etc.), not for automatic permission expiration.

Correct Answers: Configure Azure Storage encryption with customer-managed keys in Key Vault,
Set the minimum required TLS version to TLS 1.2 or higher, and Configure a private endpoint for
the storage account and restrict public network access
To meet the security requirements:
l Customer-managed key encryption: In the storage account's Encryption settings, you must select
Customer-managed keys and specify the Key Vault and key to use for encryption at rest.
l TLS version enforcement: Under Configuration, set the Minimum TLS version to TLS 1.2 or TLS 1.3 to
ensure all traffic uses secure HTTPS only.
l Private endpoint and network restriction: Under Networking, create a private endpoint in your virtual
network and change the Public network access setting to Disabled to deny public access.
Why the other options are incorrect:
l Blob-level retention policies: These policies (immutable storage) prevent deletion or modification of blobs
but do not control encryption or enforce the use of customer-managed keys.
l Shared access signatures instead of storage account keys: While SAS tokens are a security best
practice for limiting access scope, using SAS does not automatically enforce encryption with customer-
managed keys or HTTPS-only traffic. Both the policy requirement and SAS tokens are separate security
controls.

Correct Answer: Use a single Bicep file with parameters that define environment-specific values
and deploy it with a parameters file for each environment
Bicep is the modern Azure Infrastructure as Code (IaC) language that is more readable and maintainable than
ARM JSON templates. By creating a single Bicep template with parameters (such as vmSize, environment,
storageType, and nsgRules), you can deploy the same template to multiple environments by providing
different parameters files. This approach is efficient, repeatable, version-controllable, and reduces template
duplication and the risk of configuration drift.
Why the other options are incorrect:
l Separate templates for each environment: This creates duplication and maintenance overhead. When
you need to update the template logic, you must do so in multiple places, increasing the risk of
inconsistencies.
l Manually editing JSON before each deployment: This is error-prone, time-consuming, and does not
follow Infrastructure as Code best practices. It also makes it difficult to track what changed between
deployments.
l Using Azure DevOps pipelines without templates: While DevOps pipelines are useful for automation,
they do not replace the need for Infrastructure as Code templates. Pipelines should orchestrate the
deployment of well-defined templates.

Correct Answer: Use Azure Backup for App Service and Azure SQL Database automated backups
with point-in-time restore (PITR)
Azure Backup provides automated, managed backup and recovery for App Service. For databases, Azure SQL
Database includes built-in automated backups with point-in-time restore (PITR) capabilities that allow you to
recover the database to any point within the retention period (typically up to 35 days). This combination allows
you to meet a 15-minute RTO by quickly restoring both the application and database from managed backups
with minimal manual intervention. Both services are fully managed and require minimal operational overhead.
Why the other options are incorrect:
l App Service built-in backup with manual SQL snapshots: While App Service has a backup feature,
manual snapshots are operationally intensive and error-prone. They do not provide continuous protection and
recovery points.
l Storage account backup and CSV exports: CSV exports are not a reliable backup method for databases.
Storage account backups do not preserve application state or database transactions effectively. This
approach does not meet the RTO requirement.
l Azure Site Recovery without database-specific backup: Site Recovery is designed for disaster recovery
replication across regions and is not a primary backup solution. It does not provide point-in-time restore for
databases and is not optimized for App Service backup scenarios. It is also more complex and costly than
needed for this use case.

Correct Answers: Azure Monitor with diagnostic settings to collect VM metrics and logs, Azure
Monitor alerts with action groups to send notifications when thresholds are exceeded, and Log
Analytics workspace to store and query collected metrics and logs
To implement comprehensive monitoring for VMs:
l Azure Monitor: Collects platform metrics (CPU, memory, disk I/O) from VMs by default. You can enable
diagnostic settings to send additional metrics and logs to a Log Analytics workspace.
l Azure Monitor alerts: Allow you to define alert rules (e.g., CPU > 80% for 5 minutes) and associate them
with action groups that trigger notifications via email, SMS, webhooks, or automation runbooks.
l Log Analytics workspace: A central repository for storing metrics, logs, and events from multiple VMs. It
enables you to query, analyze, and retain data for compliance and long-term trend analysis.
Why the other options are incorrect:
l Azure Service Health: Tracks the health status of Azure services and planned maintenance, not individual
VM performance metrics. It does not provide real-time performance data collection.
l Application Insights: Is designed to monitor the health and performance of web applications and their
dependencies, not general virtual machine infrastructure metrics like CPU and memory.
CASE STUDY 1
Overview
Datum Corporation is a consulting firm that has a main office in Montreal and branch offices in Seattle and New York.
Azure Environment
Datum has an Azure subscription that contains three resource groups named RG1. RG2, and RG3. The subscription
contains the storage accounts shown in the following table.

Tap the image to zoom
The subscription .contains the virtual machines shown in the following table.

Tap the image to zoom
The subscription has an Azure container registry that contains the images shown in the following table.

Tap the image to zoom
The subscription contains the resources shown in the following table.

Tap the image to zoom
The subscription contains an Azure key vault named Vaultl.
Vault! contains the certificates shown in the following table.

Tap the image to zoom

Tap the image to zoom
Vaultl contains the keys shown in the following table.
Microsoft Entra Environment
Datum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the users
shown in the following table.
The lenant contains the groups shown in the following table.

Tap the image to zoom
The adatum.com tenant has a custom security attribute named Attribute1.
Planned Changes
Datum plans to implement the following changes:
* Configure a data collection rule {DCR) named DCR1 to collect only system events that have an event ID of 4648
from VM2 and VM4.
* In storage1, create a new container named cont2 that has the following access policies:
o Three stored access policies named Stored 1, Stored2, and Stored3 o A legal hold for immutable blob storage
* Whenever possible, use directories to organize storage account content.
* Grant User1 the permissions required to link Zone1 to VNet1.
* Assign Attribute1 to supported adatum.com resources.
* In storage2, create an encryption scope named Scope"1.
* Deploy new containers by using Image1 or Image2.
Technical Requirements
Datum must meet the following technical requirements:
* UseTLSforWebApp1.
* Follow the principle of least privilege.
* Grant permissions at the required scope only.
* Ensure that Scope1 is used to encrypt storage services.
* Use Azure Backup to back up cont1 and share1 as frequently as possible.
* Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.

In Microsoft Azure, encryption scopes are a StorageV2 (general-purpose v2) storage account feature that allows
fine-grained control over encryption settings for data stored within a single account. According to Microsoft
Azure Storage documentation, an encryption scope defines a specific encryption context that can be applied at
the container or blob level and is supported in non-hierarchical namespace storage accounts (those without
Data Lake Gen2 enabled).
In the given scenario:
storage1 has Hierarchical namespace = Yes (Data Lake Storage Gen2 enabled).
storage2 has Hierarchical namespace = No.
The plan was to create an encryption scope named Scope1 in storage2.
The technical requirement specifies that Scope1 must be used to encrypt storage services.
According to the Azure Administrator documentation on encryption scopes:
''Encryption scopes are supported for block blobs, append blobs, page blobs, Azure Files, queues, and tables in
standard StorageV2 accounts. Encryption scopes are not supported in hierarchical namespace (Data Lake
Gen2) enabled accounts.''
This means that Scope1---created in storage2, which does not have hierarchical namespace---can encrypt all
blob data (containers and blobs) as well as file shares, queues, and tables.
However, storage1 cannot use encryption scopes because hierarchical namespace storage accounts (ADLS
Gen2) manage encryption at the account level and do not support per-scope encryption.
Therefore, only storage2 can apply Scope1, and it can encrypt containers, blobs, file shares, queues, and
tables.

In the scenario, storage1 is configured as StorageV2 with Hierarchical namespace = Yes, while storage2 is
configured as StorageV2 with Hierarchical namespace = No.
From Microsoft's Azure Storage Documentation and AZ-104 Study Guide, the following principles apply:
A hierarchical namespace (enabled when the storage account has Azure Data Lake Storage Gen2 capabilities)
allows the use of directories within containers to organize data.
The hierarchical namespace provides directory and file-level structure similar to a file system. This is supported
only for blob containers, not for Azure Files.
Azure Files (file shares) do not depend on hierarchical namespaces and cannot have directories in the same
way Data Lake Gen2 does --- directories can exist inside the share but not in the blob container sense.
The planned change states that you must use directories whenever possible to organize content. Therefore,
only storage accounts with hierarchical namespace enabled can use directory structures --- that's storage1.
In this case:
storage1 (Hierarchical namespace = Yes) supports containers (like cont1) and file shares (like share1).
storage2 (Hierarchical namespace = No) does not support directories within blob containers (Data Lake
structure).
Hence, you can use only cont1 (container in storage1) and share1 (file share in storage1) to organize content
as required.
This is directly supported by the Microsoft documentation on Data Lake Storage Gen2:
''When you enable the hierarchical namespace for a storage account, you can organize objects into directories
and subdirectories. This capability is available only for accounts configured for Data Lake Storage Gen2.''
Final Verified Answe r: B. cont1 and share1 only

The planned change specifies that you must configure a Data Collection Rule (DCR) to collect only system
events with Event ID 4648 from VM2 and VM4.
A Data Collection Rule (DCR) in Azure Monitor defines how data is collected from resources, filtered, and sent to
destinations like Log Analytics workspaces. To define or query this data within Azure Monitor Logs or Log
Analytics, you use Kusto Query Language (KQL).
From the Microsoft Learn: Azure Monitor Logs Documentation:
''Log queries in Azure Monitor are written in Kusto Query Language (KQL), the same query language used by
Azure Data Explorer.'' ''KQL is optimized for querying large datasets, filtering by event IDs, sources, and event
types.''
Other options:
WQL (WMI Query Language) -- used for on-prem Windows event querying, not for Azure DCR.
T-SQL (Transact-SQL) -- used for Azure SQL Database queries, not for monitoring data.
XPath -- used in Event Viewer or XML-based event filtering, not within Azure Monitor DCR configuration.
Therefore, when you configure DCR1 to collect system events (Event ID 4648) from the specified VMs, the
Kusto Query Language (KQL) is the correct and verified method to filter and process these events.
Example of a valid KQL expression for this requirement:
SecurityEvent
| where EventID == 4648
| where Computer in ('VM2', 'VM4')
This aligns with the Azure Monitor and Log Analytics query methodology covered in AZ-104 official exam guide
(Implement and manage monitoring).