Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  2. Home
  3. Exams
  4. Microsoft
  5. AZ-104

Microsoft AZ-104 Exam
Microsoft Azure Administrator (Page 21 )

Updated On: 12-Jan-2026
Page 21 of 110
PDF with 553 Questions

HOTSPOT (Drag and Drop is not supported)
You purchase a new Azure subscription.
You create an Azure Resource Manager (ARM) template named deploy.json as shown in the following exhibit.


You connect to the subscription and run the following command.
New-AzDeployment –Location westus –TemplateFile “deploy.json”
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: Yes
Two resource groups are created in the copy index loop. One third is created in a separate statement.
We see:
"count": 2
Note: Syntax
Add the copy element to the resources section of your template to deploy multiple instances of the resource. The copy element has the following general format:
"copy": {
"name": "<name-of-loop>", "count": <number-of-iterations>, "mode": "serial" <or> "parallel",
"batchSize": <number-to-deploy-serially>
}
The name property is any value that identifies the loop. The count property specifies the number of iterations you want for the resource type.
Box 2: No
The resource groups created in the copyindex loop are named RGS1 and RGS2. The third resource group is named according to the statement:
"Name": "[concat('RGroup', length(parameters)('obj1')))] We see obj1 with four items (PropA, PropB, PropC, Prop4)
Length of obj1 would be 4, not 5.
Box 3: Yes
In the copy index loop we have "location": "eastus"
In the separate statement to create the third resource group we see:
We see:
"location": [last(variables('var1'))]
And var1 defined as:
"var1": [ "westus" "centraus" "eastus"
]
The location would again be eastus. Note:
The New-AzDeployment cmdlet adds a deployment at the current subscription scope. This includes the resources that the deployment requires.
To add a deployment at subscription, specify the location and a template. The location tells Azure Resource Manager where to store the deployment data.


Reference:

https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/copy-resources https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azdeployment



Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.


You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure?

  1. Microsoft Entra Application Proxy
  2. private endpoints
  3. a network security group (NSG)
  4. Azure Peering Service

Answer(s): B

Explanation:

For this question with different alternatives: Correct answers:
* private endpoints
service endpoints
Incorrect answers include:
* a network security group (NSG)
* Microsoft Entra Application Proxy
* Azure Application Gateway
* Azure Firewall
* Azure Peering Service
Azure Virtual WAN
Explanations for correct answers:
private endpoints-
You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.
service endpoints-
Private endpoints can be created in subnets that use Service Endpoints. Clients in a subnet can thus connect to one storage account using private endpoint, while using service endpoints to access others.


Reference:

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints



Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.


You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure?

  1. Microsoft Entra Application Proxy
  2. service endpoints
  3. a network security group (NSG)
  4. Azure Firewall

Answer(s): B

Explanation:

For this question with different alternatives: Correct answers:
* private endpoints
* service endpoints Incorrect answers include:
* a network security group (NSG)
* Microsoft Entra Application Proxy
* Azure Application Gateway
* Azure Firewall
* Azure Peering Service
Azure Virtual WAN
Explanations for correct answers:
private endpoints-
You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.
service endpoints-
Private endpoints can be created in subnets that use Service Endpoints. Clients in a subnet can thus connect to one storage account using private endpoint, while using service endpoints to access others.


Reference:

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints



Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.


You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure?

  1. Azure Application Gateway
  2. service endpoints
  3. a network security group (NSG)
  4. Azure Peering Service

Answer(s): B

Explanation:

For this question with different alternatives: Correct answers:
* private endpoints
service endpoints
Incorrect answers include:
* a network security group (NSG)
* Microsoft Entra Application Proxy
* Azure Application Gateway
* Azure Firewall
* Azure Peering Service
Azure Virtual WAN
Explanations for correct answers:
private endpoints-
You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet.
* service endpoints-
Private endpoints can be created in subnets that use Service Endpoints. Clients in a subnet can thus connect to one storage account using private endpoint, while using service endpoints to access others.


Reference:

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints



You have an Azure subscription named Sub1 that contains the resources shown in the following table.


You create a user named Admin1.
To what can you add Admin1 as a co-administrator?

  1. RG1
  2. MG1
  3. Sub1
  4. VM1

Answer(s): C

Explanation:

The Service Administrator and the Co-Administrators have the equivalent access of users who have been assigned the Owner role (an Azure role) at the subscription scope.


Reference:

https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles



Viewing page 21 of 110
Viewing questions 101 - 105 out of 553 questions



Post your Comments and Discuss Microsoft AZ-104 exam prep with other Community members:

Join the AZ-104 Discussion