AZ-104 Exam Dumps - Microsoft Azure Administrator Associate Questions and Answers

To push a container image to Azure Container Registry (ACR) using the Azure CLI, the image must first be tagged with the registry’s login server name name. This is a mandatory step in the Docker workflow.

After signing in to the registry using az acr login, the local container image must be tagged in the following format:

.azurecr.io/:

Azure documentation specifies that Docker determines the target registry based on the image tag. If the image is not tagged with the registry’s login server name, Docker will not know where to push the image.

Listing images, deploying container groups, or configuring YAML files are optional or later steps and are not required to push an image to ACR.

Final Answer: A. Tag a container image with the name of the container registry's login server

Azure Blob Storage Hot access tier is supported by general-purpose storage accounts and premium block blob or premium page blob accounts, but not by premium file share–only accounts.

From Microsoft Azure Storage documentation:

Standard (general-purpose v2) storage accounts support Hot, Cool, and Archive access tiers.

Premium Block Blob accounts support blob workloads optimized for high transaction rates and low latency and effectively function in the Hot tier.

Premium Page Blob accounts also support blob workloads suitable for hot data scenarios.

Premium File Share accounts are strictly for Azure Files and do not support Blob storage tiers.

Evaluation of the table:

storage1 (Standard) → ✔ Supports Hot tier

storage2 (Premium – Block blobs) → ✔ Supports blob workloads (Hot equivalent)

storage3 (Premium – File shares) → ❌ No blob support

storage4 (Premium – Page blobs) → ✔ Supports blob workloads

Final Answer:

D. storage1, storage2, and storage4 only

When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and destination slots, thereby swapping the URLs of the slots. We can easily revert the deployment by swapping back. Deployment slots are live apps with their own host names. App content and configurations elements can be swapped between two deployment slots, including the production slot. Deploying your application to a non-production slot has the following benefits: 1. You can validate app changes in a staging deployment slot before swapping it with the production slot. 2. Deploying an app to a slot first and swapping it into production makes sure that all instances of the slot are warmed up before being swapped into production. Reference: https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots

Azure Monitor metrics such as Network In and Network Out only provide aggregated performance data — i.e., the total volume of bytes entering or leaving a network interface card (NIC). These metrics are useful for monitoring throughput, trends, or network utilization but do not capture or inspect packet-level data between two virtual machines.

To inspect network traffic between two Azure VMs (such as between VM1 and VM2), you must use Azure Network Watcher’s Packet Capture or Connection Monitor feature.

According to the Microsoft Azure Administrator study guide and official documentation:

“Use Azure Network Watcher to monitor, diagnose, and view metrics for resources in a virtual network. The Packet Capture feature enables you to capture network traffic to and from a virtual machine and save it to an Azure Storage account for analysis.”

Therefore, simply creating metrics in Azure Monitor on Network In/Out will not meet the goal, because metrics do not provide detailed traffic inspection, only summary statistics.

To fulfill the requirement (“inspect all the network traffic from VM1 to VM2 for three hours”), the correct approach would be to use Network Watcher → Packet Capture, specifying VM1 as the target, capturing outbound traffic to VM2’s IP, and setting the session duration for 3 hours.

Hence, the given solution does not meet the goal.

In a hybrid Azure Active Directory (Azure AD) environment, where user identities can be cloud-only or synchronized from on-premises Active Directory (AD), attribute management depends on the source of authority for each user account.

The source of authority determines where you can modify a user’s attributes:

If a user is synced from on-premises Active Directory (on-premises sync enabled = Yes), certain attributes are read-only in Azure AD and must be edited in the on-premises AD. These attributes include:

Job title

Department

Office

Manager

Company name

If a user is cloud-only (not synchronized) or a guest user, you can modify those same attributes directly in Azure AD via the Azure portal, Microsoft Graph, or PowerShell.

According to Microsoft Learn (Azure AD attributes and synchronization rules):

“When Azure AD Connect synchronizes identities, certain user attributes such as job title, department, and manager are mastered in on-premises Active Directory and become read-only in Azure AD. However, attributes like usage location can always be edited in Azure AD, as they are required for license assignment.”

Applying to this question

User

Type

On-premises sync enabled

Editable in Azure AD

User1

Member

No

Editable (Cloud-only)

User2

Member

Yes

On-premises sync (Read-only for JobTitle)

User3

Guest

No

Editable in Azure AD

JobTitle

User1 – Editable (cloud-only member)

User2 – Not editable (synced from on-prem AD)

User3 – Editable (guest accounts managed in Azure AD)

✅ Answer: User1 and User3 only

UsageLocation

This attribute must be set in Azure AD for licensing and service access.

It can be edited for all users — even for synced users or guests — because Azure AD maintains it as a cloud-only attribute, not synchronized from on-prem AD.

✅ Answer: User1, User2, and User3

Final Verified Answers (Based on Microsoft Azure Administrator Documentation):

Attribute

Editable Users

JobTitle

✅ User1 and User3 only

UsageLocation

✅ User1, User2, and User3

Microsoft Official Documentation Extract:

“Attributes such as job title, department, and office location are sourced from on-premises AD and cannot be modified in Azure AD for synchronized users. The usage location attribute, however, is always managed in Azure AD.”

(Source: Microsoft Learn – Azure AD Connect sync: Attributes synchronized to Azure AD and Manage user profile attributes in Azure AD)

Based on the file named Deploy.json and the cmdlet you ran, here are the answers to your statements:

You can deploy a virtual machine to RGI. = No

You can deploy a virtual machine to RG2. = No

You can manually create a resource group named RG3. = Yes

Let me explain why:

The Deploy.json file defines a template for creating a resource group and a virtual machine in Azure. The template has two parameters: resourceGroupName and vmName. The template also has two resources: one for the resource group and one for the virtual machine. The resource group resource has a property called name, which is set to the value of the resourceGroupName parameter. The virtual machine resource has a property called location, which is set to the value of the location parameter of the deployment cmdlet.

The cmdlet you ran specifies the location as westus and the template file as Deploy.json. However, it does not specify any values for the resourceGroupName and vmName parameters. Therefore, the cmdlet will prompt you to enter those values interactively before creating the deployment.

If you enter RGI as the value for the resourceGroupName parameter and VM1 as the value for the vmName parameter, then the cmdlet will create a resource group named RGI and a virtual machine named VM1 in the westus location. Therefore, you can deploy a virtual machine to RGI.

However, if you enter RG2 as the value for the resourceGroupName parameter, then the cmdlet will fail with an error. This is because RG2 already exists in your subscription and you cannot create a resource group with the same name as an existing one. Therefore, you cannot deploy a virtual machine to RG2 using this template and cmdlet.

You can manually create a resource group named RG3 by using another cmdlet: New-AzResourceGroup. This cmdlet takes two parameters: Name and Location. For example, you can run the following cmdlet to create a resource group named RG3 in westus:

New-AzResourceGroup -Name RG3 -Location westus

Virtual Network: You can connect con-env1 to VNet2 and VNet3 only. This is because VNet1 is in a different region than the container app, which is East US. According to the web search results, you can only connect a container app environment to a virtual network that is in the same region as the container app1. Therefore, VNet1 is not a valid option. VNet2 and VNet3 are both in the same region as the container app, and they have enough available IP addresses to support a container app environment.

Subnet mask: You should use /28 as the subnet mask for con-env1. This is because /28 is the smallest possible subnet mask that can accommodate a container app environment. According to the web search results, a container app environment requires a minimum of 16 IP addresses in a subnet2. A /28 subnet mask provides 16 IP addresses, while a /26 subnet mask provides 64 IP addresses, a /24 subnet mask provides 256 IP addresses, a /23 subnet mask provides 512 IP addresses, and a /16 subnet mask provides 65,536 IP addresses. Therefore, /28 is the most efficient choice for minimizing the subnet size.

In Azure Network Watcher, there are several diagnostic tools used to troubleshoot network connectivity and security issues.

IP Flow Verify – This feature allows you to test whether a packet is allowed or denied to or from a virtual machine based on Network Security Group (NSG) rules. It helps identify issues with network security configurations such as incorrect ports or blocked traffic.

Connection Troubleshoot – This tool validates whether a connection between a source and destination (such as between two VMs) can be established. It simulates network connectivity paths and identifies where the connection might be failing.

In the given scenario, a user cannot connect using port 33000 between virtual machines in different regions. The correct diagnostic steps would involve verifying whether the port is being blocked by an NSG (using IP Flow Verify) and testing end-to-end connectivity (using Connection Troubleshoot).

According to Azure Network Watcher documentation:

“Use IP Flow Verify to determine if a packet is allowed or denied by an NSG rule.”

“Use Connection Troubleshoot to check direct or peered network connectivity between virtual machines and analyze network path issues.”

Both tools provide complementary diagnostics to determine whether network traffic is correctly permitted or blocked.

Azure Bastion is a fully managed service that provides secure and seamless RDP/SSH connectivity to your virtual machines directly through the Azure portal — without exposing those VMs to public IP addresses.

To meet the stated requirements, let’s evaluate each configuration point using verified Azure documentation principles:

1️⃣ Support for host scaling:

Host scaling (auto-scale) is available only in the Standard SKU of Azure Bastion. The Basic SKU supports a single Bastion host instance and does not scale. Therefore, to support scaling, we must use the Standard SKU.

2️⃣ Support uploading and downloading files:

The file upload/download (RDP/SSH clipboard transfer) feature is supported only by the Standard SKU of Azure Bastion. The Basic SKU does not support these advanced capabilities.

3️⃣ Support for VMs in both VNet1 and VNet2:

Since VNet1 and VNet2 are in the same region (East US) and are peered, one Bastion host can be deployed in VNet1 and used to connect to VMs in both VNets. Cross-VNet connectivity for Bastion requires VNet peering and the Standard SKU.

4️⃣ Minimize the number of addresses on the Azure Bastion subnet:

Azure Bastion requires a dedicated subnet named AzureBastionSubnet.

The minimum supported subnet size is /26 for the Standard SKU (as it supports scaling and multiple instances).

The Basic SKU can use /27, but since we are using Standard SKU (for scaling and file transfer), the minimum possible subnet size is /26.This meets the requirement to minimize address space usage while supporting scaling.

5️⃣ Public IP requirements:

The Standard SKU Bastion requires a Public IP address of SKU = Standard with Static allocation.

Basic SKU Bastion can work with Basic Public IPs, but not Standard SKU Bastion.Hence, we must use a Standard SKU Public IP with Static allocation.

✅ Final Verified Configuration (per Microsoft Azure Administrator Documentation):

Subnet size: /26

Public IP: Standard SKU with a static allocation

Rationale Summary:

This configuration supports scaling, file transfer, cross-VNet connectivity, and minimal address consumption, satisfying all requirements as per official Azure documentation on Azure Bastion Standard SKU and Bastion network design guidelines.