Pass the Microsoft Azure Administrator Associate AZ-104 Questions and answers with CertsForce

When Microsoft schedules maintenance that may affect a virtual machine (VM), administrators have two options:

Wait for Azure to perform the maintenance automatically.

Move the VM to a new host proactively to minimize or avoid downtime.

According to the Microsoft Azure Administrator documentation, using the “Redeploy + reapply” option in the Azure portal forces the VM to migrate to a new Azure host within the same region and availability set.

Here’s what happens when you click Redeploy:

Azure shuts down the existing VM.

The VM is moved to a new physical host within the same region.

The operating system disk and data disks are retained, and network configuration (NICs, public IP, etc.) is preserved.

Once redeployed, Azure reassigns the VM to the same virtual network and reattaches disks and configurations.

This method is explicitly recommended by Microsoft to proactively address maintenance events or host-related issues like “unresponsive VM” or “performance degradation.”

Therefore, using the Redeploy operation from the “Redeploy + reapply” blade effectively achieves the goal of moving the VM to a different host immediately.

Box 1: 10 years

The yearly backup point occurs to 1 March and its retention period is 10 years.

Box 2: 36 months

The monthly backup point occurs on the 1

of every month and its retention period is 36 months.

Note: Azure retention policy takes the longest period of retention for each backup. In case of conflict between 2 different policies.

Azure virtual machines can occasionally be subject to platform maintenance events. Maintenance can be planned (with notice) or unplanned. Planned maintenance includes updates to the host operating system or hardware that may require moving your VM to another host.

When you receive a maintenance notification, Azure provides options to move your VM proactively to minimize downtime. According to the Microsoft Azure Administrator documentation, the correct action is to use the "Redeploy" option or “Move VM to another host” from the Azure portal. This operation shuts down the VM, migrates it to a new physical node within the same region, and then restarts it — effectively resolving maintenance impact.

The Update management blade, however, is part of Azure Automation Update Management, which is used to schedule and manage operating system updates (Windows or Linux) across Azure and hybrid environments. Enabling Update Management simply connects the VM to a Log Analytics workspace and does not move or redeploy the VM.

Therefore, enabling Update Management does not achieve the goal of moving VM1 to a different host to avoid maintenance. The correct action would be:

Navigate to VM1 → Help → Redeploy + reapply → Redeploy.

This redeploys the VM to another host server while retaining its network and disk configurations.

Thus, the proposed solution does not meet the goal.

 Stored access policies: ✅ 2

 Immutable blob storage policies: ✅ 1

From the scenario in the earlier case study (A. Datum Corporation):

The planned change requires creating a new container named cont2 in storage1, with the following:

Three stored access policies (Stored1, Stored2, Stored3)

A legal hold for immutable blob storage

Also, recall from the table:

storage1 has Hierarchical namespace = Yes (Data Lake Storage Gen2 enabled).

storage2 has Hierarchical namespace = No.

The question asks: “What is the maximum number of additional access policies you can create for cont2?”

According to Microsoft Azure Storage documentation:

A blob container can have a maximum of five stored access policies.

These policies allow shared access signatures (SAS) to be managed centrally, letting you define start times, expiry times, and permissions at the container level.

Since three stored access policies (Stored1, Stored2, Stored3) already exist, the maximum additional policies that can still be created is:

→ 5 (maximum allowed) – 3 (already existing) = 2

For immutable blob storage policies:

A container can have one active immutability policy at a time.

This can be either a time-based retention policy or a legal hold policy.

Since cont2 already has a legal hold applied, no additional immutable policy can coexist with it, but it can have one defined policy type (the legal hold).

Therefore:

Stored access policies: 2 additional policies can still be created.

Immutable blob storage policies: 1 policy (the existing legal hold).

This aligns exactly with Microsoft Learn: Azure Storage Blob Service limits and immutable storage documentation:

“A container may have up to five stored access policies. Immutable storage supports either a time-based retention policy or legal hold policy per container.”

Final Verified Answer:

✅ Stored access policies: 2

✅ Immutable blob storage policies: 1

In the scenario, storage1 is configured as StorageV2 with Hierarchical namespace = Yes, while storage2 is configured as StorageV2 with Hierarchical namespace = No.

From Microsoft’s Azure Storage Documentation and AZ-104 Study Guide, the following principles apply:

A hierarchical namespace (enabled when the storage account has Azure Data Lake Storage Gen2 capabilities) allows the use of directories within containers to organize data.

The hierarchical namespace provides directory and file-level structure similar to a file system. This is supported only for blob containers, not for Azure Files.

Azure Files (file shares) do not depend on hierarchical namespaces and cannot have directories in the same way Data Lake Gen2 does — directories can exist inside the share but not in the blob container sense.

The planned change states that you must use directories whenever possible to organize content. Therefore, only storage accounts with hierarchical namespace enabled can use directory structures — that’s storage1.

In this case:

storage1 (Hierarchical namespace = Yes) → supports containers (like cont1) and file shares (like share1).

storage2 (Hierarchical namespace = No) → does not support directories within blob containers (Data Lake structure).

Hence, you can use only cont1 (container in storage1) and share1 (file share in storage1) to organize content as required.

This is directly supported by the Microsoft documentation on Data Lake Storage Gen2:

“When you enable the hierarchical namespace for a storage account, you can organize objects into directories and subdirectories. This capability is available only for accounts configured for Data Lake Storage Gen2.”

Final Verified Answer: ✅ B. cont1 and share1 only

This scenario requires two distinct tasks related to Azure Container Registry (ACR): creating the registry itself and uploading a container image into it. Microsoft Azure Administrator documentation clearly separates these responsibilities between Azure CLI and Docker CLI.

To provision a new Azure Container Registry, Microsoft documentation states that administrators must use the Azure CLI az acr create command. This command creates a private, managed Docker registry in Azure that can store and manage container images. The az acr create command defines the registry name, resource group, and pricing tier (Basic, Standard, or Premium). It is the only supported CLI command used to create an ACR resource. Commands such as az acr build, az container create, or docker create do not create a registry and therefore do not meet the requirement.

Once the registry exists, the container image must be uploaded to it. According to the Microsoft Azure Container Registry documentation, images are uploaded using standard Docker commands. After authenticating to the registry and tagging the image with the registry’s login server name, the image is transferred using the docker push command. Microsoft explicitly states that Azure CLI does not upload local images directly to ACR; instead, Docker is responsible for pushing images.

The documented workflow is:

Create the registry using az acr create.

Authenticate Docker to the registry.

Tag the image with the registry address.

Upload the image using docker push.

Therefore, the only commands that correctly satisfy the requirements are:

az acr create to provision the registry

docker push to add image1 to the registry

Final Verified Answer:

Provision a new container registry: az acr create

Add image1 to the registry: docker push

To back up a web app, you need to configure a custom backup that specifies a storage account and a container as the target for the backup1. The storage account must be in the same subscription as the web app, and the container must be accessible by the web app2. The backup size is limited to 10 GB, and the backup frequency can be configured to minimize costs.

According to the table, storage1 is the only storage account that meets these requirements. Storage1 is in the same subscription and region as the web app, and it is a general-purpose v2 account that supports custom backups. Storage2 and storage3 are in a different region than the web app, which may incur additional costs for data transfer. Storage4 is a FilesStorage account, which does not support custom backups.

Therefore, you should use storage1 as the target for the backup of your web app. To configure a custom backup, you can follow these steps:

In your app management page in the Azure portal, in the left menu, select Backups.

At the top of the Backups page, select Configure custom backups.

In Storage account, select storage1. Do the same with Container.

Specify the backup frequency, retention period, and database settings as needed.

Click Configure.

At the top of the Backups page, select Backup Now.