AZ-104 Important Azure Administrator Interview Questions 2024

1. What is Azure, and what are its main components?

Microsoft provides Azure as a cloud computing platform, comprising core elements such as computing, storage, networking, database, and security services. Utilizing these services enables users to develop, deploy, and oversee diverse applications and workloads within the cloud environment.

2. Can you define Azure Administration?

An Azure Administrator is responsible for implementing, monitoring, and maintaining Microsoft Azure solutions, which encompass fundamental services associated with computing, Storage, Network, and Security.

3. What is meant by Azure Subscriptions?

An Azure subscription serves as a logical grouping through which access to Azure resources is managed, housing information about all resources such as virtual machines (VMs), databases, and others. When creating an Azure resource like a VM, it is associated with the subscription it belongs to.
An Azure subscription encompasses:

• Billing entity and security boundary
• Container for users
• The monthly charge for Azure services

4. Is it possible for an organization to possess multiple Azure Directories?

Yes, an organization can possess multiple Azure Directories.

5. What are the specific roles and responsibilities assigned to an Azure Administrator?

The role of an Azure Administrator involves implementing, monitoring, and maintaining Microsoft Azure solutions, including essential services such as computing, networking, security, and storage. Additionally, Azure administrators are tasked with managing storage solutions for VM virtual hard disks, database files, user data, and application data.

6. What are the different power states available for a VM?

A Virtual Machine can assume different power states, including:

• Starting: Indicates that the virtual machine is being started
• Running: This indicates that the virtual machine is currently running.
• Stopping: This indicates that the virtual machine is in the process of being stopped.
• Stopped: Indicates that the virtual machine is stopped.
• Deallocating: Indicates that the virtual machine is being deallocated.
• Deallocated: This indicates that the virtual machine has been completely removed from the hypervisor but remains available in the control plane. It does not incur computing charges.

7. What is the concept of an availability set in Azure?

An availability set serves as a logical grouping of Virtual Machines (VMs) in Azure, aiding in the understanding of how an application is structured for redundancy and availability. To achieve a highly available application and meet the 99.95 percent Azure SLA, Microsoft advises creating two or more VMs within an availability set.

8. What is the count of different backup types provided by Azure?

Azure provides three types of data storage options:

• Locally Redundant Storage (LRS)
• Geo-Redundant Storage (GRS)
• Zone Redundant Storage (ZRS)

9. How do Fault Domain and Update Domain differ from each other?

In the Fault domain, resources are allocated to physically separate servers. On the other hand, the Update domain is employed to logically group resources, ensuring that specific sets of resources, such as security patches, are updated simultaneously rather than updating resources randomly.

10. What are the different categories of RBAC controls provided in Microsoft Azure?

The three RBAC control types include:

• Owner
• Reader
• Contributor

11. What exactly is Azure Resource Manager (ARM), and in what ways does it differ from the classic deployment model?

In Azure, the Azure Resource Manager (ARM) serves as a deployment model that facilitates the management of resources collectively within a resource group. With ARM, you can efficiently deploy, update, and remove resources in a synchronized and foreseeable manner. Conversely, the classic deployment model lacks these functionalities.

12. Could you explain what a virtual network is in Azure and what are its main components?

In Azure, a virtual network embodies a cloud-based network infrastructure. Core elements of this network encompass subnets, network security groups, routes, and virtual network gateways. This setup enables the establishment of a secure and segregated environment for hosting virtual machines and other resources.

13. What defines Azure Active Directory (AD) and what are its main features?

Microsoft offers Azure Active Directory (AD) as a cloud-hosted service for directory and identity management. Its functionalities encompass managing users and groups, facilitating single sign-on (SSO), implementing multi-factor authentication (MFA), and ensuring identity protection. Azure AD plays a crucial role in overseeing and safeguarding users, devices, and applications within the cloud environment.

14. Could you explain the distinction between an Azure storage account and an Azure file share?

Azure storage accounts offer scalable and resilient storage for diverse data formats such as blobs, tables, queues, and files. Conversely, an Azure file share serves as a networked file repository within Azure, accessible through the Server Message Block (SMB) protocol. Although both are components of Azure storage, their functions differ significantly.

15. What defines Azure Virtual Machine, and what functionalities does it offer?

Azure Virtual Machines provide on-demand computing resources or virtual machines within Microsoft Azure. Typically utilized as a service when needed, users can shut down the system when not in use. Categorized under Infrastructure as a Service (IaaS) in Azure, Azure Virtual Machines offer increased control over the environment for customization of development or hosting needs. The creation of resources such as networks and disks is necessary for virtual machines, and these resources can be allocated to different resource groups.

Utilizing Microsoft Azure Virtual Machines, cloud users have various deployment options, including the Azure GUI portal, Powershell, or the portal’s cloud shell. Users can access a list of all deployed VMs directly within the Azure portal. Before deploying VMs using any method, users should have sufficient knowledge of the different characteristics of VMs in the cloud.

Azure virtual machines can be created using various methods such as Azure CLI, Azure portal, REST APIs, and Azure PowerShell. For those feeling overwhelmed in the Azure environment, it’s essential to make progress efficiently. Consider joining our Microsoft Azure Certification program, where we’ll guide you through mastering Azure efficiently and on schedule.

16. How can you enable the Availability set for a couple of VMs running in Azure environments?

It’s not feasible to activate the Availability Set in active systems due to limitations. If you wish to enable it, you must recreate the VMs and include the Availability Set during the process.

17. Can the NSG be enabled within a Vnet as an alternative to enabling it at the VM level?

Enabling the NSG directly within Vnets is not feasible, but you can certainly associate it with subnets, thus streamlining the management of your NSG.

18. What does NSG stand for?

NSG, or Network Security Group, functions to permit or block specific ports for communication either within or outside your Azure subscription. It comprises inbound and outbound rules:

• Inbound Rule: Dictates traffic originating from the internet to VMs or designated services.
• Outbound Rule: Governs traffic from your VMs or specified services to the internet.

19. What is the procedure for setting up an NSG?

To create the NSG and associate it with VMs, you must follow these steps:

• Search for NSG in All Services.
• Provide the Name, Location, and Resource Group.
• Click on the NSG and proceed to create it.

20. Is it feasible to deploy the VM in one region while connecting it to another region?

Certainly, interconnectivity needs to be established during the creation of the V-net (Virtual Network) to V-net (Virtual Network) connection between both regions.

21. How does a Managed Disk differ from an Unmanaged Disk?

Managed Disk storage accounts are created and managed on the backend, providing scalability for storage accounts. These are supported by Standard/Premium Tiers.

Unmanaged Disks require creating storage accounts, creating and managing the disks manually. It’s essential to note that exceeding the storage limit of up to 20K IOPS while adding numerous disks may throttle the VM’s performance.

22. What defines a Site-to-Site VPN?

A Site-to-Site VPN gateway connection establishes a connection between your on-premises network and an Azure virtual network through an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This connection necessitates a VPN device located on-premises with an externally facing public IP address.

Azure’s Site-to-Site VPN facilitates the connection between an On-Premises Network and Azure Virtual Network over an IPsec/IKE (IKEv1/IKEv2) VPN tunnel. Essentially, this connection mandates a VPN device with a public-facing IP address assigned to it.

23. What steps can be taken to ensure that a customer’s Prod, Dev, and Test environments are isolated from each other?

Under those circumstances, you can segregate the environments by creating distinct subnets for Prod, Dev, and Test environments. Then, apply NSGs to each subnet with specific deny rules to prevent connections to those environments.

24. Could you provide an overview of Azure Backup?

Azure Backup is a cloud-based solution designed to assist in backing up Azure VMs, PaaS SQL databases, file services, web apps, and more.

25. What are the differences between Azure Resource Manager and the classic deployment model?

The key distinction between the two models lies in ARM’s provision of a structured method for resource management. Through ARM, you can designate a resource group and deploy all essential resources to that group. This streamlines resource management, organization, and the deployment and management of updates to those resources.

26. What is the significance of Azure Resource Manager (ARM) templates in Azure administration?

Azure Resource Manager (ARM) templates provide administrators with a method to consistently and repeatedly define and deploy Azure resources. These templates are authored in JSON format, enabling administrators to specify the resources they wish to create and configure, including their properties and dependencies.

27. What approaches are taken to manage storage in Azure, and what are some of the standard storage solutions that find application in Azure?

Managing storage in Azure encompasses making decisions about data storage methods, selecting storage types, and establishing data access and management protocols.
Some standard storage solutions in Azure include:

• Azure Blob Storage: Ideal for storing unstructured data such as images, videos, and text files.
• Azure Files: Used for file storage and sharing, akin to a traditional file server.
• Azure Queue Storage: Designed for storing messages that can be accessed and processed by multiple applications.
• Azure Disk Storage: Tailored for virtual machine storage, offering high performance and low latency.

To oversee storage in Azure, you can leverage the Azure Portal, Azure CLI, or Azure PowerShell. These tools enable you to create and configure storage accounts, manage access control, monitor performance and usage, and establish backup and disaster recovery procedures.

28. Could you provide an overview of Azure Site Recovery?

Azure Site Recovery, provided by Microsoft Azure, serves as a disaster recovery solution.
Some advantages of utilizing Azure Site Recovery include:

• Ensuring business continuity by enabling organizations to recover applications and data in the event of a disaster or outage.
• Replicating virtual machines from an on-premises data centre or another cloud environment to Azure or between Azure regions.
• Guaranteeing the availability and accessibility of business-critical applications and data during a disaster.
• Reducing downtime and mitigating the impact of a disaster on an organization’s operations.

29. What purpose does Azure ExpressRoute serve?

Azure ExpressRoute, a service offered by Microsoft Azure, enables secure connectivity between your on-premises infrastructure and Azure’s infrastructure.
It establishes a dedicated, private connection, bypassing the public Internet, which can be beneficial for organizations with security or compliance constraints that prohibit using the public Internet to access Azure resources.
Additionally, ExpressRoute enhances the reliability and performance of connections to Azure.

30. Can you explain the process of configuring a load balancer in Azure?

Here are the steps to establish a load balancer in Azure:

• Generate a load balancer using the Azure CLI, Azure Portal, or Azure PowerShell.
• Allocate a static public IP address to the load balancer.
• Form a backend pool containing the desired virtual machines for load balancing.
• Establish a load balancing rule to specify how the load balancer will distribute incoming traffic among the backend pool.
• Configure health probes to monitor the health status of the virtual machines.
• Create a public-facing IP configuration.
• Assign the load balancer to a subnet.
• Verify the functionality of the load balancer by accessing the public IP address.

31. What is the process for configuring backup and recovery for Azure resources?

Ensuring the protection and restoration of data and resources in Azure is crucial for safeguarding against potential disasters or data loss.
Here’s an outline of the steps involved in configuring backup and recovery in Azure:

• Determine the resources requiring protection.
• Select an appropriate backup solution.
• Configure the chosen backup solution.
• Conduct a test backup to verify functionality.
• Monitor the backup and recovery procedures.
• Execute recovery processes as necessary.

32. Could you provide an overview of managing and monitoring Azure services and resources?

For managing and monitoring Azure services and resources, a variety of tools and techniques offered by Azure can be utilized. One commonly used tool is the Azure portal, providing a web interface for managing and monitoring resources. Azure Monitor offers real-time insights into applications and infrastructure, allowing for the configuration of custom alerts. Azure Log Analytics aids in collecting, analyzing, and searching log data from multiple sources. 

33. Could you provide an overview of optimizing performance for Azure resources?

To enhance performance for Azure resources, consider implementing the following actions:

• Properly sizing resources: Select the appropriate size for virtual machines, storage, and network resources to match workload requirements and prevent over or under-provisioning.
• Monitoring resource utilization: Regularly monitor CPU, memory, and network usage to detect and resolve performance bottlenecks promptly.
• Utilizing auto-scaling: Enable auto-scaling to automatically adjust resource allocation in response to changing workload demands, ensuring optimal performance.
• Implementing caching: Utilize caching to store frequently accessed data temporarily in memory, reducing retrieval time from slower storage layers.

34. How are Azure Policy and Azure Resource Manager templates utilized to enforce compliance and security standards across Azure resources?

Azure Policy, a service within Azure, aids organizations in enforcing compliance and security standards across their Azure resources
Administrators can establish policies within Azure Policy to enforce rules and standards, such as restricting specific resource types or ensuring proper resource tagging.
Azure Resource Manager (ARM) templates, JSON files delineating Azure deployment resources and configurations, come into play. By integrating ARM templates with Azure Policy, administrators can enforce compliance and security standards throughout their organization’s Azure resources, guaranteeing consistent and secure deployment and management of all resources.

35. What steps are involved in setting up and managing virtual networks in Azure?

Setting up and managing virtual networks in Azure entails the following steps:

• Virtual Network Creation: This is achieved through the Azure portal, Azure CLI, or Azure PowerShell, where you specify subnets, address spaces, and network security groups.
• Static IP Address Assignment: If required, static IP addresses can be allocated to resources within the virtual network.
• Network Security Configuration: This involves the creation of network security groups and the establishment of inbound and outbound traffic rules.
• Connectivity Establishment: VPN or ExpressRoute connections are set up to establish connectivity between the virtual network and on-premises resources.
• Virtual Network Monitoring and Management: This includes monitoring performance, updating security settings, and modifying network configurations as necessary.
• Utilization of Azure Resource Manager Templates: These templates automate the deployment and management of virtual networks.

36. Azure Monitor and Azure Log Analytics are essential tools within Azure, facilitating the collection and analysis of logs and metrics from Azure resources.

Azure Monitor delivers real-time monitoring and alerts for Azure resources, while Log Analytics gathers log data from resources, offering advanced analytics and search functionalities. These tools empower administrators to comprehend the performance and health of their Azure resources, detect potential issues, and promptly address problems. Moreover, the data amassed by these tools enables insights into resource usage patterns, aids in troubleshooting performance issues, and enhances the overall stability and reliability of Azure resources.

37. What differentiates public, private, and hybrid clouds from each other?

Cloud deployment models exhibit variability, and comprehending their appropriateness for diverse situations is crucial.

• Public Cloud: Operated and managed by third-party providers, the public cloud enables multiple organizations to utilize shared computing resources via the Internet. It offers scalability, cost-effectiveness, and the outsourcing of infrastructure management. Nonetheless, concerns regarding data security and limited customization could be considered drawbacks.
• Private Cloud: Exclusively dedicated to a single organization, the private cloud can be either on-premises or hosted by a third party. It delivers enhanced control, security, and customization, making it suitable for businesses with stringent data privacy requirements and specialized workloads. However, it may entail higher initial expenditures and necessitate in-house management expertise.
• Hybrid Cloud: Merging elements of both public and private clouds, the hybrid cloud facilitates seamless integration and data mobility. Enterprises can leverage the scalability and cost efficiency of the public cloud for non-sensitive data while safeguarding critical applications and data within the private cloud. Effective integration and data synchronization play pivotal roles in this model.

38. How can Azure Network Watcher and Connection Monitor be utilized?

Azure Network Watcher provides tools for monitoring, diagnosing, and viewing connectivity metrics in Azure. It helps validate network configurations, troubleshoot issues, and optimize performance. Connection Monitor, part of Network Watcher, offers unified end-to-end connection monitoring. It used to:

1. Validate multi-tier application connectivity.
2. Compare cross-region network latencies.
3. Monitor on-premises to Azure connections.
4. Check Azure storage endpoint latencies.
5. Test connectivity from VM Scale Sets. It’s a powerful solution for maintaining robust and secure network communication.

39. What is Azure Disk Encryption (ADE) and how does it work?

Azure Disk Encryption (ADE) safeguards data in Azure Virtual Machines (VMs) by encrypting both OS and data disks. Here’s how it works:

• For Windows VMs, ADE uses BitLocker.
• For Linux VMs, it leverages dm-crypt.
• ADE integrates with Azure Key Vault for key management.
• It encrypts data at the Azure hypervisor level, ensuring end-to-end encryption.
• ADE is essential for meeting security and compliance requirements, adding an extra layer of protection beyond Server-Side Encryption (SSE).

40. What is Azure Bastion and what are its key features and benefits?

Azure Bastion is a fully managed Platform as a Service (PaaS) offering in Microsoft Azure that facilitates secure and seamless RDP (Remote Desktop Protocol) and SSH (Secure Shell) connectivity to virtual machines (VMs) directly from the Azure portal. Here’s an overview of its key points:
Purpose and Benefits:

• Secure Connectivity: Azure Bastion enables secure connections to VMs without exposing their public IP addresses.
• TLS Encryption: It utilizes TLS (Transport Layer Security) to establish encrypted RDP and SSH sessions over port 443.
• No Public IP Required: VMs do not require public IP addresses as Bastion connects using their private IP addresses.
• Simplified NSG Management: There is no need to manage Network Security Groups (NSGs) for individual VMs as Bastion handles secure connections.
• No Separate Bastion Host: Azure Bastion eliminates the need for a separate VM acting as a bastion host, as it is a fully managed service.

How It Works:

• Seamless Access: Administrators can access RDP or SSH sessions directly from the Azure portal without the need for special client software or public IP addresses on VMs.
• Streamlined Connection Process: Bastion simplifies the connection process, making it seamless for administrators.

Use Cases:

• Azure Portal Access: Administrators can easily connect to VMs directly from the Azure portal with a single click.
• Firewall Traversal: Bastion employs an HTML5-based web client, allowing traffic to securely traverse firewalls over port 443.
• Protection Against Scanning: VMs remain protected against port scanning as they are not exposed to the internet.
• Hardening and Updates: Azure Bastion is internally hardened and regularly updated by the Azure platform.
• Azure Bastion enhances remote access to VMs by simplifying connectivity and maintaining security best practices.