AZ-104 Exam Dumps - Microsoft Azure Administrator Associate Questions and Answers

No

No

No

In the given scenario, the storage account “contoso2023” has Allow storage account key access set to Disabled. This means that access keys and account-level Shared Access Signatures (SAS) cannot be used to authorize requests to the storage account. Only Azure AD authentication and user delegation SAS tokens are supported when key-based access is disabled.

Let’s analyze each user according to Azure’s documented storage access behavior:

User1 – User delegation SAS:

A user delegation SAS is based on Microsoft Entra (Azure AD) credentials and requires blob service (not file service).

Since the user delegation SAS can only access Blob storage, and the question specifies cont1 (Blob container), this would normally allow access if Azure AD permissions exist. However, if no RBAC permissions are granted, access is denied by default.

User2 – Service SAS:

A service SAS uses a storage account key to sign the token.

When Allow storage account key access is disabled, service SAS becomes invalid, because it relies on the account key.

Therefore, User2 cannot access blob or file data using a service SAS in this configuration.

User3 – Account SAS:

An account SAS is also generated using the storage account key.

With key access disabled, account SAS tokens are blocked, and any operation using them fails with an authorization error.

Thus, User3 cannot access the content either in the blob container or the file share.

According to Microsoft Azure Administrator Documentation:

“When you disable storage account key access, requests that use the account access keys for authorization fail. Shared access signatures (SAS) that are signed with an account key or a service SAS become invalid. Only user delegation SAS tokens, which use Azure AD credentials, are supported.”

This aligns with the behavior described in Azure Storage security documentation and AZ-104 study guides.

Box-1 : 3

Initial starts 2 VM ' s 15 minutes have passed. at 10 minutes 1 VM was added we now have 3 VM ' s. Cool down is 5 Minutes before another 10 minute wait cycle starts so the answer is 3.

Box-2: 1

Initial 5 VM ' s 60 minutes Pass. 1 VM removed every 15 minute cycle. 10 minutes wait timer plus 5 minute cool down equals 15 minutes cycle. Four 15 minute cycles pass equaling 60 minutes removing 4 VM ' s. We have 1 VM left.

Default Scale in and Out Default Durations are 10 minutes with 5 minute cool down.

The default scale set settings in Azure are:

-Minimum number of instances 1

-Maximum number of instances 10

-Scale out CPU threshold (%) 75

-Duration in minutes10

-Number of instances to increase by 1

-Scale in CPU threshold (%) 25

-Number of instances to decrease by -1

https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-portal#create-a-rule-to-automatically-scale-in

To meet the technical requirement that User1 can create initiative definitions and User4 can assign initiatives to RG2, we must understand how Azure Policy roles operate according to Microsoft Azure documentation and AZ-104 study guides.

Azure Policy uses role-based access control (RBAC) to determine who can create, manage, and assign policies or initiatives (policy sets). The key roles relevant to this task are:

Resource Policy Contributor – Allows users to create, edit, and delete policy definitions and initiative definitions, but does not allow assignment of policies or initiatives. This role is required for users who will design or build the policy logic (definitions).

Therefore, User1, who needs to create initiative definitions, must have the Resource Policy Contributor role.

Scope: Subscription (Sub1) – because initiatives are created at subscription or management group level.

Contributor – Provides full access to manage resources, except granting permissions. Contributors can assign existing policies or initiatives to resource groups or subscriptions if they have sufficient permissions.

Therefore, User4, who needs to assign initiatives to RG2, must be assigned the Contributor role at the RG2 scope.

Other roles:

Security Admin is related to Microsoft Defender for Cloud security settings, not policy creation.

Resource Policy Contributor for RG2 would not meet the requirement because creating definitions typically requires subscription-level access.

According to Microsoft Docs (“Azure built-in roles for Policy”):

“The Resource Policy Contributor role allows users to create, edit, and delete Azure policy and initiative definitions. To assign policies or initiatives, users need the Contributor or Owner role at the appropriate scope.”

Hence, the configuration should be:

User1: Resource Policy Contributor for Sub1

User4: Contributor for RG2

✅ Yes, Yes, No

WebApp1 can communicate with VM2. No, this is not correct. According to the tables, WebApp1 is integrated with VNet1, which has a peering connection with VNet2. However, VM2 is in VNet3, which is not peered with VNet1 or VNet2. Therefore, WebApp1 cannot communicate with VM2 across different virtual networks1.

NSG1 controls inbound traffic to WebApp1. No, this is not correct. According to the tables, NSG1 is associated with Subnet1 in VNet1, which is integrated with WebApp1. However, network security groups only control outbound traffic from App Service apps to virtual networks, not inbound traffic to App Service apps from virtual networks2. Therefore, NSG1 does not control inbound traffic to WebApp1.

WebApp2 can communicate with VM1. Yes, this is correct. According to the tables, WebApp2 is integrated with VNet3, which has a peering connection with VNet2. VM1 is in Subnet2 in VNet2, which has a network security group named NSG2 that allows inbound traffic from any source on port 803. Therefore, WebApp2 can communicate with VM1 on port 80 across peered virtual networks.

Azure role-based access control (Azure RBAC) for Azure file shares requires identity-based authentication integration. According to the Microsoft Azure Administrator documentation, this feature is only supported for StorageV2 (general purpose v2) and FileStorage account types.

In this scenario:

You are required to grant Group4 read-only access using Azure RBAC on Azure file shares.

The technical requirement specifies:

“Whenever possible, grant Group4 Azure RBAC read-only permissions to the Azure file shares.”

From the case study data:

Storage Account

Kind

Identity-based Access

storage1

Storage (general purpose v1)

Azure AD DS

storage2

StorageV2

Disabled

storage3

BlobStorage

N/A

storage4

FileStorage

Azure AD DS

The Storage (general purpose v1) type (storage1) does not support Azure AD or Azure RBAC integration for file shares. Microsoft documentation clearly states that “StorageV1 accounts must be upgraded to StorageV2 to support Azure AD authentication and RBAC role assignments.”

Meanwhile, FileStorage (storage4) already supports Azure AD Domain Services (Azure AD DS) and RBAC role assignment; hence no further modification is required there. However, to make storage1 compatible, it must be converted from StorageV1 to StorageV2.

Once converted to StorageV2, you can then:

Enable identity-based access for Azure file shares.

Assign Azure RBAC roles (e.g., Storage File Data Reader) to Group4.

Microsoft-Documented Requirements Summary:

Supported Account Types: StorageV2 or FileStorage

Unsupported: StorageV1 and BlobStorage

Required RBAC Roles for Read-Only Access:

Storage File Data Reader (or custom read-only role)

Thus, to meet the organization’s requirement to provide Azure RBAC read-only permissions, you must change the account type of storage1 to StorageV2, ensuring both storage1 and storage4 can be managed with Azure RBAC.

https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept#how-are-role-assignable-groups-protected

" Group nesting isn ' t supported. A group can ' t be added as a member of a role-assignable group. "

For the second question:

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-manage-groups#add-or-remove-a-group-from-another-group

" We currently don ' t support:

Adding Microsoft 365 groups to Security groups or other Microsoft 365 groups.

"

For the third question, although it appears truncated in the screenshot (ending with " for... " ) there is a reference about Microsoft 365 groups support for roles assignment here:

https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept#how-role-assignments-to-groups-work

" To assign a role to a group, you must create a new security or Microsoft 365 group with the isAssignableToRole property set to true. "

In Azure Active Directory (Microsoft Entra ID), dynamic group membership rules allow administrators to automatically include or exclude users based on specific user attributes (such as department, country, job title, etc.). These rules use the Azure AD dynamic membership rule syntax, which is a logical query language similar to PowerShell filtering.

Scenario Requirements

You need to:

Create a Microsoft 365 group (Office 365 group).

Automatically include users who meet both of the following conditions:

The user’s department is Marketing.

The user’s country is France.

This requires a compound logical condition using the and operator to ensure both criteria are true.

1. Attribute Names

According to Microsoft Azure AD dynamic membership documentation, the supported attributes for user membership rules include:

user.department → represents the department assigned to the user profile.

user.country → represents the country or region defined for the user.

Both attributes are supported and commonly used in group dynamic membership rules.

2. Operators

The operator -eq is used for equality comparison in dynamic rules.

Microsoft documentation states:

“Use the -eq operator to test equality. The operator is case-insensitive and compares attribute values to string literals.”

For logical combinations, and joins multiple expressions together so that all conditions must be true for membership.

3. Syntax Construction

To meet both conditions:

(user.department -eq " Marketing " ) and (user.country -eq " France " )

user.department -eq " Marketing " → Selects all users in the Marketing department.

and → Ensures the next condition must also be true.

user.country -eq " France " → Filters those users located in France.

This rule will dynamically add users who belong to the Marketing department and are located in France to the group.

4. Microsoft Official Source Extract

From Microsoft Learn (“Rules for dynamically populated groups in Azure Active Directory”):

“You can build complex rules with multiple expressions joined by -and, -or, and -not operators. For example:

(user.department -eq " Sales " ) and (user.country -eq " US " )”

This is directly analogous to the required rule for Marketing users in France.

✅ Final Verified Answer:

Dynamic membership rule:

(user.department -eq " Marketing " ) and (user.country -eq " France " )

Summary:

Attribute 1: user.department

Operator 1: -eq

Logical Operator: and

Attribute 2: user.country

Operator 2: -eq

Value: " France "

Hence, the dynamic rule correctly and efficiently includes only Marketing users located in France, as per Azure AD Administrator documentation and Microsoft’s official membership rule syntax.

In Microsoft Azure, Azure Resource Manager (ARM) templates are JSON-based files used to define and automate the deployment of Azure resources in a consistent and repeatable manner. To deploy an ARM template, the PowerShell cmdlet you use depends on the deployment scope — whether the template targets a tenant, management group, subscription, or resource group.

According to the Microsoft Azure Administrator documentation (AZ-104 Study Guide, “Deploy and Manage Azure Resource Manager Templates”):

New-AzTenantDeployment → Used for tenant-level deployments, typically involving management group creation or tenant-wide policies.

New-AzSubscriptionDeployment → Used for subscription-level deployments, when resources are created directly under the subscription rather than within a resource group.

New-AzResourceGroupDeployment → Used for resource group-level deployments, which is the most common scenario for creating and managing resources such as virtual machines, storage accounts, and virtual networks.

New-AzDeployment → An older alias that may refer to subscription-level deployments in older Az modules but is not the standard for resource group deployments.

In this question, the ARM template defines both a resource group and a storage account that will be deployed within that resource group. Therefore, the correct PowerShell cmdlet to use is:

New-AzResourceGroupDeployment `

-ResourceGroupName < RGName > `

-TemplateFile < PathToTemplateFile >

This cmdlet processes the specified ARM template file, validates the schema, and provisions all the resources defined in the template inside the target resource group.

Hence, based on the Azure Resource Manager official documentation and exam objectives, the correct answer is:

Azure Import/Export service supports the following of storage accounts:

✑ Standard General Purpose v2 storage accounts (recommended for most scenarios)

✑ Blob Storage accounts

✑ General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments),

Azure Import/Export service supports the following storage types:

✑ Import supports Azure Blob storage and Azure File storage

✑ Export supports Azure Blob storage. Azure Files not supported.

Only storage4 can be exported.