Microsoft Azure Administrator AZ-104

An operator must restart virtual machines in one resource group but must not assign roles. Which built-in role and scope best fit?

A company must prevent new Azure resources from being deployed outside approved regions. Which control should it assign?

An application must read blobs with Microsoft Entra authentication. Its identity has only Reader on the storage account. What additional permission is needed for blob content?

A storage account uses a private endpoint. A VM resolves the account name to a public IP and cannot reach it after public access is disabled. What should be checked first?

A team needs an Azure Blob object to remain recoverable after accidental deletion during a configured retention period. Which feature directly addresses that event?

An administrator applies a CanNotDelete lock to a resource group. What behavior should be expected for resources inheriting it?

Two peered virtual networks use address spaces 10.0.0.0/16 and 10.0.0.0/16. Why does the design need revision?

An inbound NSG has an allow rule at priority 200 and a matching deny rule at priority 300. Which rule determines the result for that traffic?

A team needs identical VMs to increase or decrease in number according to demand. Which Azure capability is the best starting point?

An administrator wants to query guest operating-system events centrally. What must be configured beyond simply viewing the Azure Activity Log?

A production VM must be restored after corruption of its application files. Which preparation most directly supports this recovery?

An application identity should access Azure Key Vault without storing a client secret in its configuration. Which mechanism fits?