Microsoft AZ-104 Practice Exam
Microsoft Azure Administrator AZ-104
The Microsoft Azure Administrator AZ-104 exam validates the skills to implement, manage and monitor an organization's Azure environment. It is weighted across five domains: manage Azure identities and governance at 20 to 25 percent, implement and manage storage at 15 to 20 percent, deploy and manage Azure compute resources at 20 to 25 percent, implement and manage virtual networking at 15 to 20 percent, and monitor and maintain Azure resources at 10 to 15 percent. Questions are scenario based and cover roles and policy, storage access and redundancy, virtual machines, containers, App Service, network security, load balancing and backup. This practice exam mirrors that scope with single-answer and multiple-answer questions and drag-and-drop matching, each with a worked explanation.
Question bank updated : questions, answers, explanations and chapters.
Certification Overview
- Exam name: AZ-104
- Vendor: Microsoft
- Exam code: AZ-104
- Duration: 100 minutes
- Total questions: about 50
- Official passing score: 700 on a scale of 1 to 1,000 (source)
- Our practice exam pass mark: 70%
Who Should Take This Exam?
Azure Administrator, Cloud Administrator, Systems Administrator, Infrastructure Engineer, Cloud Engineer, Network Administrator, Virtualization Administrator, Support Engineer
Prerequisites
No formal prerequisite. Microsoft expects familiarity with operating systems, networking, servers and virtualization, and experience with PowerShell, the Azure CLI, the Azure portal, ARM templates or Bicep, and Microsoft Entra ID.
Topics Covered
- Manage Azure identities and governance
- Implement and manage storage
- Deploy and manage Azure compute resources
- Implement and manage virtual networking
- Monitor and maintain Azure resources
Question Types
- Multiple Choice (Single Answer)
- Multiple Choice (Multiple Answers)
- Drag and Drop
AZ-104 Practice Questions
Our question bank contains 650+ practice questions for this certification. Sample questions from each exam chapter. Expand a question to see the answer choices. With a subscription, you get unlimited practice exams with randomised questions from our full question bank.
Manage Azure identities and governance
A company synchronizes on-premises Active Directory to Microsoft Entra ID and enables self-service password reset. A reset performed in the cloud must also change the user's on-premises password. What must be enabled?
- A. Pass-through authentication in Microsoft Entra Connect
- B. Password hash synchronization in Microsoft Entra Connect
- C. Seamless single sign-on in Microsoft Entra Connect
- D. Password writeback in Microsoft Entra Connect Correct answer
Option D is correct because password writeback is what lets a password reset performed in the cloud be written back to the on-premises Active Directory account. Pass-through authentication, password hash synchronization and seamless single sign-on only affect how users sign in, not where a reset is written.
A company has no on-premises directory and must create 200 cloud user accounts listed in a CSV file. Which operation in the Microsoft Entra admin center should the administrator use?
- A. Bulk update users
- B. Bulk create users Correct answer
- C. Microsoft Entra Connect cloud sync
- D. Bulk invite users
Option B is correct because Bulk create users in the Microsoft Entra admin center creates cloud accounts from a CSV template. Bulk update changes existing users, bulk invite creates guests, and Microsoft Entra Connect cloud sync needs an on-premises directory that this company doesn't have.
Every user whose department attribute is Sales must be in the Sales-Team group automatically, including future hires. The tenant has Microsoft Entra ID P1. Which configuration should be used?
- A. Add the Sales users to a new administrative unit
- B. Create a Dynamic Device group that filters on the department attribute
- C. Add the current Sales users to a group with Assigned membership
- D. Create a Dynamic User group with the rule user.department -eq "Sales" Correct answer
Option D is correct because a Dynamic User group with the rule user.department -eq "Sales" adds current and future Sales users automatically, and dynamic groups are available with Microsoft Entra ID P1. A Dynamic Device group evaluates device attributes, while assigned membership and administrative units are not rule-driven.
Which two group types can be selected when an administrator creates a group in the Microsoft Entra admin center? (Choose two.)
- A. Distribution
- B. Mail-enabled security
- C. Dynamic distribution
- D. Microsoft 365 Correct answer
- E. Security Correct answer
Options D and E are correct because the Entra admin center offers exactly two group types when creating a group: Security and Microsoft 365. Distribution, mail-enabled security and dynamic distribution groups are Exchange Online constructs and cannot be created from the Entra admin center.
Implement and manage storage
Which kind of shared access signature is signed with Microsoft Entra credentials rather than with a storage account key?
- A. User delegation SAS Correct answer
- B. Account SAS
- C. Service SAS that references a stored access policy
- D. Service SAS
Option A is correct because a user delegation SAS is signed with a key obtained using Microsoft Entra credentials, not the account key. Account SAS and service SAS (with or without a stored access policy) are all signed with the storage account key.
A consulting firm's contractor has no Entra account and needs read access to every blob in one container for two weeks. The firm wants to be able to cut that access off early without regenerating the account keys. What should the administrator issue?
- A. An ad hoc service SAS on the container with a 14-day expiry
- B. An account SAS for the blob service with a 14-day expiry
- C. A service SAS tied to a stored access policy on the container Correct answer
- D. A user delegation SAS on the container with a 14-day expiry
Option C is correct because a service SAS tied to a stored access policy can be revoked by deleting or editing the policy, without regenerating the account keys. Ad hoc service and account SAS tokens carry their own expiry and can only be invalidated by rotating the signing key, and a user delegation SAS needs an Entra identity, which the contractor does not have.
VMs in the snet-app subnet (10.1.0.0/24) get 403 errors from a storage account whose firewall allows selected networks, and the subnet is not listed. Which action lets the VMs reach the account over the Azure backbone?
- A. Add 10.1.0.0/24 to the storage account firewall IP rules
- B. Enable the trusted Azure services exception on the account
- C. Enable the Microsoft.Storage endpoint on the subnet and add a VNet rule Correct answer
- D. Assign Storage Blob Data Contributor to the managed identity of the VMs
Option C is correct because enabling the Microsoft.Storage service endpoint on the subnet and adding a virtual network rule lets traffic reach the account over the Azure backbone. Private RFC 1918 ranges cannot be added as IP rules, the trusted services exception does not cover VMs in a subnet, and an RBAC role does not alter network-level firewall decisions.
Which three identity sources can provide identity-based SMB authentication for an Azure file share? (Choose three.)
- A. Microsoft Entra External ID for customers
- B. On-premises Active Directory Domain Services Correct answer
- C. Okta as a SAML identity provider
- D. Microsoft Entra Kerberos for hybrid identities Correct answer
- E. Active Directory Federation Services
- F. Microsoft Entra Domain Services Correct answer
Options B, D and F are correct because Azure Files identity-based SMB authentication supports on-premises Active Directory Domain Services, Microsoft Entra Domain Services, and Microsoft Entra Kerberos for hybrid identities. Entra External ID for customers, Okta over SAML and AD FS are not supported identity sources for SMB Kerberos authentication to a file share.
Deploy and manage Azure compute resources
A developer needs to deploy main.bicep to the existing resource group rg-web by using the Azure CLI. Which command does this?
- A. az deployment group create --resource-group rg-web --template-file main.bicep Correct answer
- B. az deployment sub create --location uksouth --template-file main.bicep
- C. az deployment mg create --management-group-id contoso --location uksouth --template-file main.bicep
- D. az bicep build --file main.bicep
Option A is correct because a deployment to an existing resource group uses az deployment group create with --resource-group. Option B targets a subscription and C a management group, both of which need --location rather than a resource group, and D (az bicep build) only compiles the file to JSON without deploying anything.
Before the production release, a team wants a preview that lists which resources a Bicep file would create, modify or delete, without changing anything. Which command provides that?
- A. az deployment group show --name previous-release
- B. az group export --name rg-prod
- C. az deployment group validate --template-file main.bicep
- D. az deployment group what-if --template-file main.bicep Correct answer
Option D is correct because az deployment group what-if previews which resources would be created, modified or deleted without changing anything. Option C (validate) only checks that the template is valid and does not list the changes, A shows a past deployment, and B exports the current state of a resource group.
An organization has a working ARM template in JSON, azuredeploy.json, and wants to maintain it from now on as a Bicep file. Which command produces the Bicep file?
- A. az bicep build --file azuredeploy.json
- B. az bicep upgrade
- C. az bicep decompile --file azuredeploy.json Correct answer
- D. az deployment group export --name azuredeploy
Option C is correct because az bicep decompile converts an ARM JSON template into a Bicep file. Option A (az bicep build) does the reverse, compiling Bicep to JSON, B only upgrades the Bicep CLI, and D exports a template from an existing deployment rather than producing Bicep.
An administrator is deciding which files can be given to the --template-file parameter of the az deployment group create command. Which two file types does the parameter accept? (Choose two.)
- A. A Bicep file with the .bicep extension Correct answer
- B. A YAML pipeline definition
- C. A PowerShell script with the .ps1 extension
- D. A Terraform configuration with the .tf extension
- E. An ARM template written in JSON Correct answer
Options A and E are correct because --template-file accepts either a Bicep file or an ARM template in JSON, and the Azure CLI compiles Bicep to ARM before deployment. A YAML pipeline definition, a PowerShell script and a Terraform configuration are not deployment templates that Azure Resource Manager understands, so the command rejects them.
Implement and manage virtual networking
Which dedicated subnet name does Azure require for a VPN gateway deployed into an existing virtual network?
- A. GatewaySubnet Correct answer
- B. RouteServerSubnet
- C. AzureBastionSubnet
- D. AzureFirewallSubnet
Option A is correct because a VPN gateway must be deployed into a subnet named exactly GatewaySubnet. RouteServerSubnet is for Azure Route Server, AzureBastionSubnet for Azure Bastion, and AzureFirewallSubnet for Azure Firewall.
VMs in the Web subnet (10.0.1.0/24) must send their outbound internet traffic through a network virtual appliance at 10.0.2.4 in another subnet of the same virtual network. What should the administrator configure?
- A. Associate a route table holding 0.0.0.0/0 with next hop 10.0.2.4 with the appliance's own subnet
- B. Enable IP forwarding on the network interfaces of the Web VMs
- C. Associate a route table holding 0.0.0.0/0 with next hop 10.0.2.4 with the Web subnet Correct answer
- D. Add an outbound NSG rule on the Web subnet that sets the destination to 10.0.2.4
Option C is correct because a user-defined route for 0.0.0.0/0 with next hop 10.0.2.4 must be associated with the subnet whose traffic is being steered, the Web subnet. Associating it with the appliance's subnet affects the wrong traffic, IP forwarding on the Web VMs is not what is needed (it belongs on the appliance NIC), and an NSG rule cannot change the next hop.
Spoke VMs must reach the on-premises network through a VPN gateway that sits in the peered hub virtual network. Which peering settings enable this?
- A. Enable Allow forwarded traffic on the hub peering and Use remote gateway on the spoke peering
- B. Enable Use remote gateway on the hub peering and Allow gateway transit on the spoke peering
- C. Enable Allow gateway transit on the hub peering and Use remote gateway on the spoke peering Correct answer
- D. Enable Allow gateway transit on both peerings
Option C is correct because the hub peering needs Allow gateway transit, which lets peers use its VPN gateway, and the spoke peering needs Use remote gateway to send on-premises traffic through it. Gateway transit is set on the side that owns the gateway and Use remote gateway on the side that consumes it, so options A, B and D have the settings on the wrong sides or omit one.
Which three next hop types appear in the effective routes of a subnet in a new virtual network that has no peering, gateway, service endpoint or custom route? (Choose three.)
- A. Internet Correct answer
- B. Virtual network gateway
- C. None Correct answer
- D. VirtualNetworkServiceEndpoint
- E. Virtual network Correct answer
- F. Virtual appliance
Options A, C and E are correct. A new virtual network has only system default routes: the virtual network prefix uses the Virtual network next hop, 0.0.0.0/0 uses Internet, and the private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 100.64.0.0/10 use None. Virtual network gateway, VirtualNetworkServiceEndpoint and Virtual appliance only appear once a gateway, a service endpoint or a custom route is added.
Monitor and maintain Azure resources
Which Azure Monitor tool is used to run Kusto Query Language (KQL) queries against collected log data?
- A. Azure Advisor
- B. Metrics Explorer
- C. Log Analytics Correct answer
- D. Network Watcher
Option C is correct because Log Analytics is the Azure Monitor tool for writing and running KQL queries against data stored in a Log Analytics workspace. Azure Advisor gives recommendations, Metrics Explorer charts numeric metrics, and Network Watcher diagnoses network connectivity, so none of them run KQL log queries.
Last week a virtual machine was deleted from a subscription, and the administrator needs to find out who performed the deletion. Which data source records this?
- A. The virtual machine's boot diagnostics
- B. The Microsoft Entra ID sign-in logs
- C. The virtual machine's guest performance counters
- D. The subscription's activity log Correct answer
Option D is correct because the subscription's activity log records control-plane operations such as a VM deletion, including who performed it and when. Boot diagnostics and guest performance counters show nothing about resource management actions, and Entra ID sign-in logs record sign-ins rather than Azure Resource Manager operations.
Where are the backup frequency and retention period for Azure VM backups defined?
- A. In the storage account's lifecycle rules
- B. In the VM's auto-shutdown settings
- C. In a data collection rule on the VM
- D. In a backup policy in the vault Correct answer
Option D is correct because backup frequency and retention are defined in a backup policy stored in the Recovery Services vault or Backup vault, then assigned to the VM. Storage lifecycle rules, auto-shutdown settings and data collection rules relate to blob tiering, VM power schedules and monitoring data, not backups.
Which two kinds of data does Azure Monitor collect for a new Azure resource with no diagnostic setting or agent configured? (Choose two.)
- A. Platform metrics Correct answer
- B. Application Insights request telemetry
- C. Resource logs
- D. Guest OS performance counters
- E. Activity log events Correct answer
Options A and E are correct because platform metrics and the activity log are collected automatically for every Azure resource with no configuration. Resource logs need a diagnostic setting, guest OS counters need an agent, and Application Insights telemetry needs instrumentation, so B, C and D are not collected by default.
Free Study Guide
Read the free Microsoft AZ-104 study guide: every exam topic explained in plain English, with diagrams, exam tips and the mistakes to avoid.
More Microsoft Practice Exams
- Microsoft AI-103 Practice Exam
- Microsoft AI-200 Practice Exam
- Microsoft AI-901 Practice Exam
- Microsoft AZ-305 Practice Exam
- Microsoft AZ-400 Practice Exam
- Microsoft AZ-900 Practice Exam
- Microsoft DP-600 Practice Exam
- Microsoft DP-700 Practice Exam
- Microsoft DP-900 Practice Exam
- Microsoft MD-102 Practice Exam
- Microsoft PL-300 Practice Exam
- Microsoft SC-100 Practice Exam
Practise with realistic mock exams to prepare for your Microsoft certification.