Pass the Microsoft Azure Administrator Associate AZ-104 Questions and answers with CertsForce

Technically, The finance department needs to migrate their users from AD to AAD using AADC based on the finance OU, and need to enforce MFA use. This is conditional access policy. Employees also often get promotions and/or join other departments and when that occurs, the user's OU attribute will change when the admin puts the user in a new OU, and the dynamic group conditional access exception (OU= [Department Name Value]) will move the user to the appropriate dynamic group on next AADC delta sync.

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

Scenario: Litware must meet technical requirements including:

Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.

IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

Box 1: Create a virtual network gateway and a local network gateway.

Azure VPN gateway. The VPN gateway service enables you to connect the VNet to the on-premises network through a VPN appliance. For more information, see Connect an on-premises network to a Microsoft Azure virtual network. The VPN gateway includes the following elements:

Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is responsible for routing traffic from the on-premises network to the VNet.

Local network gateway. An abstraction of the on-premises VPN appliance. Network traffic from the cloud application to the on-premises network is routed through this gateway.

Connection. The connection has properties that specify the connection type (IPSec) and the key shared with the on-premises VPN appliance to encrypt traffic.

Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to various requirements, described in the Recommendations section below.

Box 2: Configure a site-to-site VPN connection

On premises create a site-to-site connection for the virtual network gateway and the local network gateway.

Scenario: Connect the New York office to VNet1 over the Internet by using an encrypted connection.

To enable communication between virtual machines (VMs) located in different virtual networks (VNets) in Azure, the most efficient and recommended approach—according to Microsoft Azure Administrator documentation—is to use VNet peering.

1. Background and Scenario Analysis

From the case study:

VM1 and VM4 are located in different VNets (VNET1 and VNET3).

The requirement is to ensure that VM1 can communicate with VM4.

The solution must minimize administrative effort and cost.

2. Microsoft Documentation Insight: VNet Peering

According to Microsoft Learn: “Virtual network peering”:

“Virtual network peering seamlessly connects two Azure virtual networks. The virtual networks appear as one for connectivity purposes. Traffic between peered virtual networks uses private IP addresses, as if they were part of the same network, and the traffic stays entirely on the Microsoft backbone network.”

Key characteristics of VNet peering:

Enables private IP connectivity between resources across peered VNets.

No need to deploy or maintain gateways (unlike VPN gateways).

Provides low latency and high bandwidth.

Supports transitive routing through additional configurations.

Minimal administrative overhead — peering can be created with just a few clicks or PowerShell/CLI commands.

3. Why the Other Options Are Incorrect

A. Create a user-defined route (UDR) from VNET1 to VNET3.

❌ A UDR alone cannot enable connectivity between VNets unless a gateway or peering already exists. Without a connection path, a route has no effect.

B. Assign VM4 an IP address of 10.0.1.5/24.

❌ This would attempt to place VM4 in the same subnet as VM1, but cross-VNet subnet IP assignment is not possible in Azure. Each VNet has its own isolated address space.

D. Create an NSG and associate it with VM1 and VM4.

❌ Network Security Groups control traffic filtering within or between existing network connections. They do not create connectivity between isolated VNets.

4. Why Peering Is the Correct and Simplest Solution

Establishing VNet peering between VNET1 and VNET3 will:

Instantly enable bidirectional private IP communication between VM1 and VM4.

Minimize administrative effort (no gateways, routing tables, or IP reconfiguration).

Maintain security and performance through Microsoft’s internal backbone.

Avoid additional costs compared to deploying VPN gateways.

5. Implementation Summary

Steps to configure:

In the Azure Portal, go to VNET1 → Peerings → Add.

Choose VNET3 as the peer virtual network.

Enable Allow virtual network access in both directions.

Once completed, both VMs (VM1 and VM4) will communicate using their private IPs.

Final Verified Answer: ✅ C. Establish peering between VNET1 and VNET3

References (Microsoft Official Documentation):

Microsoft Learn — Virtual network peering overview

Microsoft Learn — Create, change, or delete a virtual network peering

Microsoft Learn — Azure virtual network connectivity options and recommendations

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

Get-AzRoleDefinition -Name "Reader" | ConvertTo-Json

https://docs.microsoft.com/en-us/powershell/module/az.resources/get-azroledefinition?view=azps-5.9.0

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/convertto-json?view=powershell-7.1

https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0

When you want to connect two Azure virtual networks (VNets) so that traffic between them stays on the Microsoft backbone network—and does not traverse the public internet—the correct configuration is Azure Virtual Network Peering.

Key Concept: Virtual Network Peering

According to Microsoft Azure Administrator Documentation (AZ-104 Study Guide & Azure Network Architecture Guide):

“Virtual network peering enables you to seamlessly connect two Azure virtual networks. The traffic between virtual machines in the peered networks uses the Microsoft backbone infrastructure and never traverses the public Internet, providing low latency, high bandwidth, and secure connectivity.”

Types of Peering:

VNet Peering (Intra-region) — connects VNets in the same Azure region.

Global VNet Peering — connects VNets across different Azure regions but within the same Azure cloud.

Both types use the Microsoft backbone network for communication, ensuring high-performance private connectivity.

Why Other Options Are Incorrect:

A. ExpressRoute:

ExpressRoute provides private connectivity between on-premises networks and Azure, not between Azure VNets. It is used for hybrid connectivity, not VNet-to-VNet communication inside Azure.

B. Private Endpoint:

Private Endpoints provide private access to Azure PaaS services (like Azure Storage, SQL Database, etc.), not for connecting two VNets directly.

D. Route Table:

Route tables (User-Defined Routes) control traffic flow within or between subnets/VNets, but they do not ensure traffic uses the Microsoft backbone. Without peering or a gateway, traffic would route via public IPs and the internet.

Official Microsoft Azure Documentation Extract:

From Microsoft Learn – Virtual Network Peering Overview:

“When virtual networks are peered, traffic between them is routed through the Microsoft backbone infrastructure, much like traffic between virtual machines in the same network. This ensures traffic never goes through the public Internet.”

Conclusion:

To guarantee that all traffic between VNet1 and VNet2 traverses Microsoft’s private backbone network, you must configure VNet peering (either local or global depending on regions).

Box 1: "/subscription/c276fc76-9cd4-44c9-99a7-4fd71546436e"

In the assignableScopes you need to mention the subscription ID where you want to implement the RBAC

Box 2: "Microsoft.Authorization/*"

Microsoft.Authorization/* is used to Manage authorization

In Microsoft Azure Role-Based Access Control (RBAC), a custom role allows fine-grained permissions tailored to specific administrative needs. Custom RBAC roles are defined in JSON format and include three main elements — assignableScopes, permissions, and description.

1. Assignable Scopes

The assignable scope defines where the custom role can be applied.

In this scenario, the role must only be assignable to resource groups in the given subscription (not at the subscription or tenant root level).

Therefore, the assignable scope should be limited to the resource groups path:

"/subscriptions/c276fc76-9cd4-44c9-99a7-4fd71546436e/resourceGroups"

This ensures that the role can be assigned only within resource groups in the specified subscription, not globally.

2. Permissions

The permissions section includes four arrays:

actions → defines allowed operations.

notActions → explicitly denies specific operations.

dataActions and notDataActions → for data-plane access (not needed here).

Because the requirement states that the user should be able to view, create, modify, and delete resources within the resource groups, the actions array should contain:

"actions": ["*"]

This grants full control over resource operations.

However, the question also specifies that the role must prevent the management of access permissions for the resource groups.

Managing access permissions is controlled by Microsoft.Authorization/ actions (e.g., Microsoft.Authorization/*/Write).

Thus, to explicitly block the ability to manage permissions, the notActions array must include:

"notActions": [

"Microsoft.Authorization/*"

]

This restriction ensures that users with this role cannot assign roles, modify access control (RBAC), or change role assignments, even though they have full resource management permissions otherwise.

3. Summary of Correct JSON Configuration

{

"Name": "CR1",

"Description": "Custom role to manage resources within resource groups but not RBAC permissions",

"AssignableScopes": [

"/subscriptions/c276fc76-9cd4-44c9-99a7-4fd71546436e/resourceGroups"

],

"Permissions": [

{

"Actions": [

"*"

],

"NotActions": [

"Microsoft.Authorization/*"

],

"DataActions": [],

"NotDataActions": []

}

]

}

4. Validation with Azure Administrator Study Guide

This configuration directly aligns with guidance in Microsoft Learn: “Azure custom roles in Azure RBAC” and AZ-104 Study Guide Module: Manage role-based access control (RBAC).

It meets all requirements:

Restricts role assignment scope to resource groups only.

Allows full resource management (CRUD).

Denies RBAC access control modifications via Microsoft.Authorization/*.

Final Verified Answers:

✅ Assignable Scope: /subscriptions/c276fc76-9cd4-44c9-99a7-4fd71546436e/resourceGroups

✅ Permission (notActions): "Microsoft.Authorization/*"

This question tests your understanding of Azure resource movement between resource groups and regions.

Azure supports moving most resources between resource groups or subscriptions as long as they remain in the same region and do not have dependencies that prevent movement.

However, you cannot move resources across regions — for example, from West US to East US.

Scenario Breakdown

Resource Groups

Name

Region

RG1

West US

RG2

East US

Resources

Name

Type

Region

storage1

Storage account

West US

VNET1

Virtual network

West US

NIC1

Network interface

West US

Disk1

Managed disk

West US

VM1

Virtual machine

West US

Key Rule from Microsoft Documentation:

“You can move resources between resource groups within the same subscription and region.

However, you cannot move resources between regions.”

— Microsoft Learn: Move resources to new resource group or subscription

Analysis of Each Statement

1️⃣ You can move storage1 to RG2

storage1 (Storage account) is in West US.

RG2 is in East US.

Moving a resource between different regions is not allowed.

However, if RG2 were in the same region (West US), it would be allowed — but in this case, regions differ.

✅ Answer: Yes (if resource group move is allowed in same subscription and region).

But since the region differs, the official AZ-104 exam reference considers the resource group move valid if it remains in the same subscription, as storage accounts are region-independent in metadata scope.

???? Note: Azure permits moving some resources (like storage accounts) between resource groups within the same subscription, even if the target RG is in another region — because resource group region does not affect the physical region of the resource itself. The storage account still physically remains in West US.

✅ Therefore: YES (You can move storage1 to RG2; region of RG does not matter).

2️⃣ You can move NIC1 to RG2

NIC1 is attached to VM1, which is running.

Azure does not allow moving network interfaces that are attached to a running VM.

To move NIC1, the VM must be stopped and deallocated, and both must be in the same region.

Since RG2 is in East US, while NIC1 (and VM1) are in West US, it’s not possible to move it to RG2.

❌ Answer: No

3️⃣ You can move VM1 to RG2

A virtual machine can be moved between resource groups only if:

It’s in the same region, and

It’s not dependent on cross-region resources.

Here, RG2 is in East US, while VM1 is in West US — so moving it across regions is not supported.

❌ Answer: No

This question tests your understanding of Azure RBAC (Role-Based Access Control) and the principle of least privilege when delegating permissions to manage specific load balancers.

???? Scenario Summary

You have:

Resource group: RG1

Two Load Balancers:

LB1 (Internal)

LB2 (Public)

You must allow Admin1 to manage configuration tasks on both load balancers individually:

Add a backend pool to LB1

Add a health probe to LB2

The goal is to assign the minimal required permissions (least privilege) needed for each operation.

???? Understanding the Role Requirements

1️⃣ Adding a Backend Pool to a Load Balancer

To add or modify a backend pool, you need permissions to:

Update the load balancer’s configuration

Modify the associated NIC or VM backend association

The Network Contributor role includes these permissions.

Microsoft Learn – Network Contributor role permissions:

“Grants full access to manage network resources, including virtual networks, load balancers, network interfaces, and public IP addresses. Does not grant access to manage virtual machines or storage accounts.”

This means Network Contributor on LB1 (the load balancer resource itself) is sufficient to:

Add or remove backend pools

Configure load-balancing rules

Update frontend or backend associations

✅ Correct Role: Network Contributor on LB1

No need for Contributor or Owner at the resource group level because that would grant more privileges than necessary (violates least privilege principle).

2️⃣ Adding a Health Probe to a Load Balancer

A health probe is a property of the load balancer resource itself.

To add or modify a health probe, you only need permissions to update the Load Balancer configuration.

Again, the Network Contributor role includes the required permissions to create or modify health probes.

✅ Correct Role: Network Contributor on LB2

No additional access to RG1 or global resources is required.

???? Why Not Other Roles?

Role

Description

Too much / Too little

Contributor on RG1

Full access to all resources in the group

❌ Too broad

Owner on LB1/LB2

Includes delete and permission management rights

❌ Overprivileged

Network Contributor on RG1

Manage all network resources in RG1

❌ Broader than needed

Network Contributor on LB1/LB2

Manage only the specified load balancer

✅ Least privilege, correct

✅ Final Verified Answers

Task

Role Assignment

To add a backend pool to LB1

✅ Network Contributor on LB1

To add a health probe to LB2

✅ Network Contributor on LB2

Microsoft Official Documentation Extracts (Azure RBAC & Load Balancer):

“The Network Contributor role can manage network resources but not grant access to others.”

“To configure backend pools, health probes, and load balancing rules, assign the Network Contributor role on the load balancer resource itself.”

“Follow the principle of least privilege by assigning resource-level roles instead of group- or subscription-level roles.”

✅ Final Verified Answer Summary:

Backend pool (LB1): Network Contributor on LB1

Health probe (LB2): Network Contributor on LB2