Free Microsoft Azure Administrator AZ-104 Actual Questions and Answers — Questions and Answers
Question 1: Your business has several divisions. There are several virtual machines in each department (VMs). <br> The business has a resource group called RG1 in its Azure subscription. <br> RG1 is the location of all VMs. <br> Each VM should be connected to the appropriate department. <br> What should you do?
- Create a resource group for each department.
- Create Azure Management Groups for each department.
- Modify the settings of the virtual machines.
- Assign tags to the virtual machines. (Correct answer)
Correct answer: Assign tags to the virtual machines.
Assigning tags to the virtual machines lets you attach department metadata to each VM while they all remain in the single resource group RG1, supporting organization, filtering, and billing. Creating new resource groups or management groups would require moving the VMs, and changing VM settings doesn't establish a department association — so tags are the right answer.
Question 2: You intend to add a virtual machine running Ubuntu Server to your company's Azure subscription. <br> You must implement a unique deployment that includes the addition of a specific trusted root certification authority (CA) <br> Which of the following should you use to create the virtual machine?
- The New-AzVM cmdlet.
- The New-AzureRmVm cmdlet
- The az vm create command.
- The Create-AzVM cmdlet. (Correct answer)
Correct answer: The Create-AzVM cmdlet.
Deploying a VM with a unique configuration like a specific trusted root certification authority requires the scripting and granular control of PowerShell, using the New-AzVM cmdlet. The az CLI command and the deprecated New-AzureRmVm don't provide the same setup here. ⚠ The stored key ('Create-AzVM') is wrong — no such cmdlet exists; the correct cmdlet is New-AzVM.
Question 3: Azure Active Directory (Azure AD) is a service that your business subscribes to. <br> <br> You wish to establish a conditional access policy for Azure AD. <br> <br> When connecting to Azure AD from untrusted places, members of the Global Administrators group must utilize Multi-Factor Authentication and a device that is connected to Azure AD. <br> <br> Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy. <br> <br> Does the solution meet the goal?
- Yes (Correct answer)
- No
Correct answer: Yes
Requirements like enforcing Multi-Factor Authentication and requiring an Azure AD–joined/compliant device are configured under the GRANT controls of a Conditional Access policy. Since the solution modifies the grant control, it meets the goal, so the answer is Yes.
Question 4: Azure Active Directory (Azure AD) is a service that your business subscribes to. <br> You wish to establish a conditional access policy for Azure AD. <br> When connecting to Azure AD from untrusted places, members of the Global Administrators group must utilize Multi-Factor Authentication and a device that is connected to Azure AD. <br> Solution: To change the session control of the Azure AD conditional access policy, log in to the Azure portal. <br> Does the solution meet the goal?
- Yes
- No (Correct answer)
Correct answer: No
MFA and device requirements are enforced through GRANT controls, not session controls — session controls only manage the experience after access is already granted (e.g., app-enforced restrictions, sign-in frequency). Because this solution edits the session control instead, it does not meet the goal, so the answer is No.
Question 5: Azure Active Directory (Azure AD) is a subscription owned by your business. <br> You wish to establish a conditional access policy for Azure AD. <br> When connecting to Azure AD from untrusted places, members of the Global Administrators group must utilize Multi-Factor Authentication and a device that is connected to Azure AD. <br> Solution: To change the user settings, go to the multi-factor authentication page. <br> Is the aim being met by the solution?
- Yes
- No (Correct answer)
Correct answer: No
The multi-factor authentication page only lets you enable or disable MFA on a per-user basis — it cannot enforce MFA based on conditions like sign-in location or require an Azure AD-joined device. Those conditional requirements (untrusted locations, Global Administrators, device state) can only be enforced with an Azure AD Conditional Access policy, so changing user settings on the MFA page does not meet the goal.
Question 6: Your company's Azure solution uses multi-factor authentication when users are not in the office. The use model has been set to the Per Authentication option. <br> You are notified that these workers should also utilize Multi-Factor Authentication after purchasing a smaller firm and enrolling the new workforce in Azure Active Directory (Azure AD). <br> To achieve this, the Per Enabled User setting must be set for the usage model. <br> Solution: You make a backup of the data from the current Multi-Factor Authentication provider and use it to construct a new Multi-Factor Authentication provider. <br> Does the solution meet the goal?
- Yes
- No (Correct answer)
Correct answer: No
You cannot change the usage model (for example from Per Authentication to Per Enabled User) on an existing MFA provider, and simply backing up data to build a new provider does not, by itself, transition the new workforce onto the required model — the answer is No because the described action doesn't accomplish the stated billing/enforcement change. The correct approach is to create a new provider configured with the desired usage model and link it to the directory.
Question 7: Your company's Azure solution uses multi-factor authentication when users are not in the office. The use model has been set to the Per Authentication option. <br> You are notified that these workers should also utilize Multi-Factor Authentication after purchasing a smaller firm and enrolling the new workforce in Azure Active Directory (Azure AD). <br> To achieve this, the Per Enabled User setting must be set for the usage model. <br> Solution: You make a backup of the data from the current Multi-Factor Authentication provider and use it to construct a new Multi-Factor Authentication provider. <br> Does the solution meet the goal?
- Yes (Correct answer)
- No
Correct answer: Yes
The usage model of an Azure MFA provider is fixed at creation and cannot be edited afterward, so the only way to switch from Per Authentication to Per Enabled User is to create a brand-new provider. Backing up the existing provider's data and using it to build the new provider achieves this, so the solution meets the goal.
Free Microsoft Azure Administrator AZ-104 Actual Questions and Answers
Your business has several divisions.
There are several virtual machines in each department (VMs).
The business has a resource group called RG1 in its Azure subscription.
RG1 is the location of all VMs.
Each VM should be connected to the appropriate department.
What should you do?