AZ-104: Microsoft Azure Administrator Practice Exam

What the AZ-104 exam covers

• Manage Azure Identities and Governance219 questions
• Implement and Manage Storage190 questions
• Deploy and Manage Azure Compute Resources195 questions
• Implement and Manage Virtual Networking189 questions
• Monitor and Maintain Azure Resources152 questions

Free AZ-104 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 945.

1. Question 1Manage Azure Identities and Governance

   You need to ensure that users in the Sales department are automatically added to a security group named SalesTeam. What type of group membership should you configure?

   • AAssigned membership
   • BMicrosoft 365 group with assigned membership
   • CDynamic device membership
   • DDynamic user membershipCorrect
   ✓ Correct answer: D

   Dynamic user membership groups in Microsoft Entra ID use attribute-based rules to automatically add and remove users based on their properties. For example, a rule such as user.department -eq "Sales" would automatically include all users whose department attribute is set to Sales. This feature requires Microsoft Entra ID P1 or P2 licensing and eliminates the need for manual group management.

   Why the other options are wrong

   • AAssigned membership requires an administrator to manually add and remove users, which does not meet the automation requirement.
   • BMicrosoft 365 group with assigned membership is a collaboration group type and still requires manual member management rather than automatic population.
   • CDynamic device membership evaluates device attributes, not user attributes like department, so it cannot filter users by their Sales department membership.
2. Question 2Manage Azure Identities and GovernanceSelect all that apply

   You need to implement a policy that prevents users from creating virtual machines with more than 4 vCPUs in any resource group within a subscription. Which two steps are required? (Choose two.)

   • ACreate a custom Azure Policy definition with a deny effect that checks the VM SKU against allowed sizesCorrect
   • BConfigure a budget alert in Azure Cost Management
   • CCreate an Microsoft Entra ID Conditional Access policy to block VM creation
   • DAssign the policy to the subscription scopeCorrect
   ✓ Correct answer: A, D

   To prevent users from creating virtual machines with more than 4 vCPUs, you need two steps. First, create a custom Azure Policy definition that uses a deny effect and includes a rule that evaluates the VM SKU (size) against a list of allowed sizes that have 4 or fewer vCPUs. The deny effect ensures that any deployment request for a non-compliant VM size is blocked before the resource is created. Second, assign this policy at the subscription scope so that it applies to all resource groups within the subscription, providing comprehensive coverage without needing to assign the policy individually to each resource group.

   Why the other options are wrong

   • BConfiguring a budget alert in Azure Cost Management monitors spending and sends notifications but cannot prevent the deployment of specific VM sizes.
   • CCreating a Microsoft Entra ID Conditional Access policy controls user sign-in conditions and authentication requirements but has no capability to restrict which Azure resources can be deployed.
3. Question 3Implement and Manage Storage

   Azure Storage accounts require globally unique names because the account name is used as part of the URI for accessing storage resources.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   Azure Storage account names must be globally unique across all of Azure because the account name is incorporated directly into the endpoint URI used to access storage resources. For example, a storage account named "mystorage" generates endpoints such as https://mystorage.blob.core.windows.net for Blob storage, https://mystorage.file.core.windows.net for File storage, and similar patterns for Queue and Table storage. Since these URIs must resolve to a specific storage account through DNS, no two storage accounts in any Azure subscription or tenant can share the same name. Storage account names must be between 3 and 24 characters long and can only contain lowercase letters and numbers. This is confirmed by Microsoft Azure documentation for the AZ-104 exam.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true: Azure Storage account names must be globally unique across all of Azure because the account name is incorporated directly into the endpoint URI used to access storage resources.
4. Question 4Deploy and Manage Azure Compute Resources

   Coho Vineyard has a Windows Server VM named VM-Web1 running in Azure. The VM is part of the Standard_D4s_v3 size family. The application running on VM-Web1 now requires more memory but the same number of CPUs. You need to resize the VM with minimal downtime. What should you do?

   • ADelete the VM, then recreate it with a larger memory-optimized size and reattach the existing OS and data disks.
   • BResize the VM to a memory-optimized size in the same region from the Azure portal while the VM is running, if the target size is available on the current hardware cluster.Correct
   • CCreate a new memory-optimized VM in the same region, then migrate the application, data, and settings manually from VM-Web1 before cutting over.
   • DIncrease the VM's assigned RAM directly in the Azure portal VM configuration blade while keeping the same Standard_D4s_v3 size and vCPU count.
   ✓ Correct answer: B

   Azure can resize a running VM in place to any size that the VM's current host hardware cluster supports, applying the change with only a brief reboot. Choosing a memory-optimized size keeps the CPU count similar while increasing RAM, which matches the application's need for more memory and the same CPUs. This in-place resize minimizes downtime compared with deleting and recreating the VM. If the target size were not available on the current cluster, you would first need to deallocate the VM.

   Why the other options are wrong

   • ADeleting and recreating the VM causes significant downtime and risks losing NIC, IP, and extension configuration; a live resize to a compatible size achieves the change with far less disruption.
   • CBuilding a new VM and manually migrating the application is time-consuming and error-prone with substantial downtime, which contradicts the requirement to resize with minimal downtime.
   • DAzure VM memory is fixed by the chosen VM size; you cannot add RAM independently, so you must change the VM to a larger memory-optimized size rather than editing RAM directly.
5. Question 5Deploy and Manage Azure Compute Resources

   You need to deploy an ARM template. Which command do you use?

   • Aaz deployment group createCorrect
   • Baz resource create
   • Caz group create
   • Daz vm create
   ✓ Correct answer: A

   The az deployment group create command is the Azure CLI command used to deploy an ARM template to a specific resource group. It accepts the template file, optional parameters file, and resource group name as inputs. This command supports both incremental and complete deployment modes and is the standard method for ARM template deployments via the CLI.

   Why the other options are wrong

   • Baz resource create is used to create an individual Azure resource by specifying its properties directly, not for deploying ARM templates.
   • Caz group create is used to create a new resource group in Azure, not to deploy templates.
   • Daz vm create is a shortcut command specifically for creating a virtual machine, not for deploying general ARM templates.
6. Question 6Implement and Manage Virtual Networking

   A. Datum Corporation needs to connect their on-premises datacenter to Azure with a private, dedicated connection that does not traverse the public internet and provides guaranteed bandwidth. Which service should they use?

   • AAzure VPN Gateway with site-to-site connection
   • BAzure ExpressRouteCorrect
   • CAzure Bastion
   • DAzure Virtual WAN with VPN
   ✓ Correct answer: B

   Azure ExpressRoute provides a private, dedicated connection between on-premises infrastructure and Azure datacenters through a connectivity provider. Unlike VPN connections that traverse the public internet, ExpressRoute connections do not go over the public internet, offering more reliability, faster speeds, consistent latencies, and higher security. ExpressRoute supports guaranteed bandwidth options ranging from 50 Mbps to 100 Gbps, ensuring predictable network performance for critical workloads. This makes it the ideal choice when the requirements explicitly state private connectivity, no public internet traversal, and guaranteed bandwidth.

   Why the other options are wrong

   • AAzure VPN Gateway with site-to-site connection is incorrect because VPN Gateway creates an encrypted IPsec/IKE tunnel that traverses the public internet, which does not meet the requirement of a connection that does not traverse the public internet.
   • CAzure Bastion is incorrect because Bastion is a PaaS service that provides secure RDP and SSH access to virtual machines through the Azure portal, not a network connectivity service for connecting on-premises datacenters to Azure.
   • DAzure Virtual WAN with VPN is incorrect because while Virtual WAN simplifies networking architecture, VPN connections within Virtual WAN still traverse the public internet and do not provide dedicated private bandwidth.
7. Question 7Monitor and Maintain Azure Resources

   Contoso Ltd needs to monitor the availability of a public-facing web application by sending synthetic HTTP requests from multiple global locations at regular intervals. What should you configure?

   • AApplication Insights availability testsCorrect
   • BAzure Load Balancer health probes
   • CAzure Network Watcher connection monitor
   • DAzure Traffic Manager health probes
   ✓ Correct answer: A

   Application Insights availability tests, also known as web tests, allow you to configure synthetic HTTP requests that are sent to your web application from multiple Azure test locations around the world at regular intervals. These tests check whether your application is responding correctly and within acceptable response times. You can configure URL ping tests for simple endpoint monitoring or multi-step web tests for more complex scenarios. When your application fails to respond or exceeds the configured response time threshold from any test location, an alert is triggered. This provides comprehensive global availability monitoring for public-facing web applications.

   Why the other options are wrong

   • BAzure Load Balancer health probes is incorrect because Load Balancer health probes monitor the health of backend pool members for traffic distribution purposes and do not send synthetic requests from multiple global locations.
   • CAzure Network Watcher connection monitor is incorrect because connection monitor tests network connectivity between Azure resources or between Azure and on-premises endpoints, not global web application availability from multiple geographic locations.
   • DAzure Traffic Manager health probes is incorrect because Traffic Manager health probes check endpoint health for DNS-based traffic routing decisions and do not provide the comprehensive availability testing and alerting capabilities of Application Insights availability tests.
8. Question 8Implement and Manage Storage

   Contoso Ltd operates a media processing platform that stores large video files in Azure Blob Storage. The company recently completed an audit and discovered that approximately 60% of the stored video files have not been accessed in over 180 days, but must remain available for on-demand retrieval within a few hours when customers request them. The storage costs have been increasing steadily, and the finance team has asked the IT department to reduce blob storage costs by at least 40% without deleting any data. Requirements: - Files not accessed for 180 days must be moved to a lower-cost tier automatically - Files must be retrievable within a few hours when needed - No manual intervention should be required for tier transitions - The solution must minimize administrative overhead What should you configure?

   • ACreate a lifecycle management policy to move blobs to the Cool tier after 180 days
   • BCreate a lifecycle management policy to move blobs to the Archive tier after 180 daysCorrect
   • CUse AzCopy to schedule a weekly job that moves old blobs to the Archive tier
   • DCreate a lifecycle management policy to delete blobs after 180 days and rely on soft delete for recovery
   ✓ Correct answer: B

   Azure Blob Storage lifecycle management policies allow you to define rule-based actions that automatically transition blobs between access tiers based on last modified or last accessed time. For this scenario, moving blobs to the Archive tier after 180 days provides the greatest cost reduction because the Archive tier offers the lowest storage cost per gigabyte in Azure Blob Storage. Since the requirement states files must be retrievable within a few hours, the Archive tier is appropriate because rehydrating blobs from Archive to Hot or Cool tier takes up to 15 hours with standard priority, which meets the "within a few hours" requirement. Lifecycle management policies run automatically with no manual intervention, meeting the requirement for minimal administrative overhead.

   Why the other options are wrong

   • ACreate a lifecycle management policy to move blobs to the Cool tier after 180 days is incorrect because while the Cool tier is cheaper than Hot, it does not provide the 40% or greater cost reduction that the Archive tier delivers, and the scenario specifically requires at least a 40% cost reduction.
   • CUse AzCopy to schedule a weekly job that moves old blobs to the Archive tier is incorrect because this requires manual scheduling and management of a recurring job, which does not meet the requirement for no manual intervention and minimal administrative overhead.
   • DCreate a lifecycle management policy to delete blobs after 180 days and rely on soft delete for recovery is incorrect because the requirement explicitly states that no data should be deleted, and soft delete has a limited retention period that would not provide long-term data availability.
9. Question 9Manage Azure Identities and Governance

   You configure Privileged Identity Management (PIM) as shown in the table. Which user currently has an active role assignment that allows them to manage user accounts?

   • AUser1
   • BUser2Correct
   • CUser3
   • DUser4
   ✓ Correct answer: B

   User2 has the User Administrator role with an Active assignment type and a Permanent state, meaning the role is currently active and does not require activation through PIM. The User Administrator role grants permissions to manage user accounts, including creating, modifying, and deleting users, resetting passwords, and managing licenses. This is the only user who currently has an active role assignment that specifically allows user account management.

   Why the other options are wrong

   • AUser1 is incorrect because although the Global Administrator role includes user management capabilities, User1's assignment is Eligible and Not activated, meaning they must go through the PIM activation process before the role becomes active.
   • CUser3 is incorrect because the Billing Administrator role manages billing and subscription settings, not user accounts, even though User3 has activated their eligible assignment.
   • DUser4 is incorrect because the Security Administrator role manages security settings and policies, not user accounts, and the assignment is Eligible and Not activated.
10. Question 10Implement and Manage Virtual Networking

    You have the load balancers shown in the table. You need to add VM7, which is in an availability zone, to one of the backend pools. To which load balancer backend pool can you add VM7?

    • APool-Web on LB-Web only
    • BPool-App on LB-App only
    • CPool-Web or Pool-AppCorrect
    • DPool-Legacy on LB-Legacy
    ✓ Correct answer: C

    Standard SKU load balancers support VMs in availability zones, while Basic SKU load balancers do not. VM7 is deployed in an availability zone, so it can only be added to backend pools of Standard SKU load balancers. Both LB-Web and LB-App are Standard SKU, making both Pool-Web and Pool-App valid options.

    Why the other options are wrong

    • APool-Web on LB-Web only is incorrect because Pool-App on LB-App is also a Standard SKU backend pool that supports availability zones.
    • BPool-App on LB-App only is incorrect because Pool-Web on LB-Web is equally valid for the same reason.
    • DPool-Legacy on LB-Legacy is incorrect because LB-Legacy uses the Basic SKU, which does not support VMs in availability zones.

Related Microsoft resources

• AZ-104 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

AZ-104 practice exam FAQ