AZ-104: Microsoft Azure Administrator Practice Exam

What the AZ-104 exam covers

• Manage Azure Identities and Governance225 questions
• Implement and Manage Storage195 questions
• Deploy and Manage Azure Compute Resources200 questions
• Implement and Manage Virtual Networking194 questions
• Monitor and Maintain Azure Resources142 questions

Free AZ-104 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 955.

1. Question 1Manage Azure Identities and Governance

   You need to ensure that users in the Sales department are automatically added to a security group named SalesTeam. What type of group membership should you configure?

   • AAssigned membership
   • BMicrosoft 365 group with assigned membership
   • CDynamic device membership
   • DDynamic user membershipCorrect
   ✓ Correct answer: D

   Dynamic user membership groups in Microsoft Entra ID use attribute-based rules to automatically add and remove users based on their properties. For example, a rule such as user.department -eq "Sales" would automatically include all users whose department attribute is set to Sales. This feature requires Microsoft Entra ID P1 or P2 licensing and eliminates the need for manual group management.

   Why the other options are wrong

   • AAssigned membership requires an administrator to manually add and remove users, which does not meet the automation requirement.
   • BMicrosoft 365 group with assigned membership is a collaboration group type and still requires manual member management rather than automatic population.
   • CDynamic device membership evaluates device attributes, not user attributes like department, so it cannot filter users by their Sales department membership.
2. Question 2Manage Azure Identities and Governance

   Azure role-based access control (RBAC) role assignments are inherited from parent scopes. A role assigned at the subscription level automatically applies to all resource groups and resources within that subscription.

   • AFalse
   • BTrueCorrect
   ✓ Correct answer: B

   Azure RBAC uses a hierarchical scope model where role assignments are inherited from parent scopes to child scopes. When you assign a role at the subscription level, that assignment automatically applies to all resource groups and individual resources within that subscription. Similarly, a role assigned at a management group level flows down to all subscriptions, resource groups, and resources beneath it. This inheritance simplifies access management by allowing administrators to grant permissions at a higher scope rather than assigning roles individually at each resource. However, this also means careful planning is required to avoid unintentionally granting overly broad access. The statement is true because RBAC role assignments at the subscription level are inherited by all child resource groups and resources within that subscription.

   Why the other options are wrong

   • AFalse is incorrect. The statement is true: Azure RBAC uses a hierarchical scope model where role assignments are inherited from parent scopes to child scopes.
3. Question 3Implement and Manage Storage

   Litware Inc stores critical financial documents in an Azure Storage account using Blob storage. Regulatory requirements mandate that these documents must be retained for 7 years and cannot be modified or deleted during the retention period. What should you configure?

   • AA lifecycle management policy to move blobs to archive tier
   • BSoft delete with a 7-year retention period
   • CAzure Backup with a 7-year backup retention policy
   • DA time-based retention policy with immutable blob storageCorrect
   ✓ Correct answer: D

   Immutable blob storage with a time-based retention policy is specifically designed for regulatory compliance scenarios where data must be retained in an unmodifiable, undeletable state for a defined period. When a time-based retention policy is applied to a container and locked, blobs within that container cannot be modified or deleted until the retention period expires. For a 7-year retention requirement on critical financial documents, this feature ensures that the data meets WORM (Write Once, Read Many) compliance standards required by regulations such as SEC 17a-4(f), FINRA 4511, and similar financial industry mandates. Once the policy is locked, it cannot be shortened or removed by any user, including subscription owners.

   Why the other options are wrong

   • AA lifecycle management policy to move blobs to the Archive tier manages storage costs by transitioning data between access tiers but does not prevent modification or deletion of the blobs during the retention period.
   • BSoft delete with a 7-year retention period allows recovery of deleted blobs during the retention window but does not prevent intentional deletion or modification of the original blobs.
   • CAzure Backup with a 7-year backup retention policy creates recovery copies of the data but does not enforce immutability on the original blobs in the storage account, meaning they could still be modified or deleted.
4. Question 4Deploy and Manage Azure Compute Resources

   Humongous Insurance has deployed an Azure App Service web app named app-claims. The app requires a connection string to an Azure SQL database. The security team mandates that no secrets be stored in application code or configuration files. You need to configure the connection string securely. What should you do?

   • AStore the connection string in the App Service application settings and connection strings section, which the platform encrypts at rest and injects as an environment variable at runtime so it stays out of the code.
   • BStore the connection string encrypted inside the application's web.config file and decrypt it at startup using a certificate that you upload to the App Service certificate store and reference from code.
   • CStore the connection string in a private Azure Storage blob secured with a SAS token, then have the application read and cache it into memory each time it starts so it is never written in the code.
   • DStore the connection string in Azure Key Vault, enable a system-assigned managed identity on the App Service, grant it access, and reference the secret via a Key Vault reference in configuration.Correct
   ✓ Correct answer: D

   Azure Key Vault provides a centralized and secure location for storing secrets such as connection strings, API keys, and certificates. By enabling a system-assigned managed identity on the App Service, the application can authenticate to Key Vault without requiring any credentials to be stored in code or configuration files.

   Why the other options are wrong

   • AApp settings keep the secret value in the site configuration where it is visible to anyone with management access and stored outside a secrets vault, which does not meet the mandate that no secrets be stored in configuration.
   • BPlacing the connection string in web.config still stores the secret in a configuration file that ships with the app, and managing decryption certificates adds risk; this directly violates the no-secrets-in-config requirement.
   • CReading the secret from a storage blob just moves the secret into another data store and still requires a credential to access that blob, so it does not centralize secret management or satisfy the security mandate.
5. Question 5Deploy and Manage Azure Compute Resources

   What does Azure Spot VM provide?

   • AReserved instance pricing
   • BPremium SSD storage
   • CDedicated hardware
   • DUnused compute capacity at a discountCorrect
   ✓ Correct answer: D

   Azure Spot VMs allow you to take advantage of unused Azure compute capacity at significantly reduced prices compared to pay-as-go rates. These VMs are ideal for workloads that can tolerate interruptions, such as batch processing, dev/test environments, and large-scale compute jobs. The trade-off is that Azure can evict Spot VMs at any time when it needs the capacity back.

   Why the other options are wrong

   • AReserved instance pricing provides discounts through long-term commitments but is a separate pricing model from Spot VMs.
   • BPremium SSD storage is a disk type option and is not related to what Spot VMs provide.
   • CDedicated hardware is provided by Azure Dedicated Host, which gives you a physical server dedicated to your organization.
6. Question 6Implement and Manage Virtual NetworkingSelect all that apply

   Fabrikam Inc. is deploying Azure Private Endpoints to secure access to their Azure SQL Database. Which TWO of the following statements about Private Endpoints are correct? (Choose TWO)

   • APrivate Endpoints can only be created in the same region as the Azure service
   • BPrivate Endpoints automatically disable all public access to the Azure service
   • CA Private Endpoint assigns a private IP address from the virtual network to the Azure serviceCorrect
   • DDNS configuration is required to resolve the service's FQDN to the Private Endpoint IP addressCorrect
   ✓ Correct answer: C, D

   When you create a Private Endpoint for an Azure service like SQL Database, Azure provisions a network interface in your specified subnet with a private IP address from that subnet's address range. This effectively brings the Azure service into your virtual network. For applications to connect using the service's standard FQDN (e.g., myserver.database.windows.net), DNS must be configured to resolve that FQDN to the Private Endpoint's private IP address instead of the service's public IP. This is typically accomplished using Azure Private DNS zones with the appropriate zone name (e.g., privatelink.database.windows.net) linked to the virtual network.

   Why the other options are wrong

   • APrivate Endpoints can only be created in the same region as the Azure service is incorrect because Private Endpoints support cross-region connectivity; you can create a Private Endpoint in a different region from the target Azure service.
   • BPrivate Endpoints automatically disable all public access to the Azure service is incorrect because creating a Private Endpoint does not automatically disable public access; you must separately configure the service's network settings to deny public network access if you want to restrict access to only the Private Endpoint.
7. Question 7Monitor and Maintain Azure Resources

   You have deployed a Log Analytics workspace and need to query logs to find all failed sign-in attempts to Azure VMs over the last 24 hours. Which table should you query in KQL?

   • ASecurityEventCorrect
   • BHeartbeat
   • CAzureActivity
   • DPerf
   ✓ Correct answer: A

   The SecurityEvent table in a Log Analytics workspace contains Windows Security event log data collected from Azure VMs and on-premises machines via monitoring agents. This table includes all Windows security events such as logon successes and failures, account management events, and privilege use events. For failed sign-in attempts, you would query for EventID 4625 (failed logon) in the SecurityEvent table with a time filter of the last 24 hours using KQL syntax like: SecurityEvent | where TimeGenerated > ago(24h) | where EventID == 4625. This is the primary table for investigating authentication-related security events on Windows VMs.

   Why the other options are wrong

   • BHeartbeat is incorrect because the Heartbeat table records agent connectivity status and health check information, confirming that monitoring agents are reporting data, not security sign-in events.
   • CAzureActivity is incorrect because the AzureActivity table logs Azure Resource Manager control plane operations such as resource creation, modification, and deletion, not operating system-level sign-in events on VMs.
   • DPerf is incorrect because the Perf table stores performance counter data such as CPU utilization, memory usage, and disk I/O metrics, not security or authentication events.
8. Question 8Deploy and Manage Azure Compute Resources

   Litware Inc runs a containerized microservices application that consists of 15 services. The application requires container orchestration with automatic scaling, rolling updates, service discovery, and persistent storage. The operations team has extensive experience with Kubernetes and needs full control over cluster configuration, networking policies, and RBAC. The application must run in production with high availability across multiple nodes. Requirements: - Full Kubernetes API compatibility - Support for custom networking policies using Calico or Azure CNI - Ability to configure node pools with different VM sizes for different workloads - Integration with Microsoft Entra ID for cluster RBAC - Managed control plane to reduce operational overhead Which Azure service should you use?

   • AAzure Container Instances (ACI)
   • BAzure Kubernetes Service (AKS)Correct
   • CAzure App Service with custom containers
   • DAzure Container Apps
   ✓ Correct answer: B

   AKS is the fully managed Kubernetes service on Azure that provides a managed control plane while giving full access to the Kubernetes API. It supports all stated requirements: full Kubernetes API compatibility, custom networking policies using Calico or Azure CNI, multiple node pools with different VM sizes for heterogeneous workloads, Microsoft Entra ID integration for cluster RBAC, and a managed control plane that eliminates the need to manage master nodes. AKS is purpose-built for production Kubernetes workloads requiring extensive orchestration capabilities.

   Why the other options are wrong

   • AAzure Container Instances (ACI) is incorrect because ACI is a serverless container platform designed for simple, isolated container workloads. It does not provide Kubernetes orchestration, node pools, or networking policies.
   • CAzure App Service with custom containers is incorrect because App Service does not provide Kubernetes API compatibility, custom networking policies, or node pool configuration. It abstracts away infrastructure management beyond what is needed here.
   • DAzure Container Apps is incorrect because while it is built on Kubernetes, it abstracts away the Kubernetes API and does not provide direct access to the Kubernetes control plane, custom networking policies like Calico, or configurable node pools.
9. Question 9Manage Azure Identities and Governance

   You have the administrative units shown in the table. Admin2 attempts to reset the password of a user in the Marketing department. What happens?

   • AThe password reset succeeds because Password Administrator can reset passwords for all users
   • BThe password reset fails because Admin2's role is scoped to AU-Engineering onlyCorrect
   • CThe password reset succeeds because administrative unit scoping is not enforced
   • DThe password reset fails because only User Administrators can reset passwords
   ✓ Correct answer: B

   Administrative units in Microsoft Entra ID provide a way to restrict the scope of Entra ID roles to a specific organizational boundary. When a role is assigned with an administrative unit scope, the administrator can only perform that role's actions on users, groups, or devices that are members of that specific administrative unit. Admin2 has the Password Administrator role scoped to AU-Engineering, which means Admin2 can only reset passwords for users who are members of the AU-Engineering administrative unit. Users in the Marketing department belong to AU-Marketing, which is outside Admin2's scope of authority.

   Why the other options are wrong

   • AThe password reset succeeds because Password Administrator can reset passwords for all users is incorrect because the role is scoped to AU-Engineering, limiting its reach to only users within that administrative unit.
   • CThe password reset succeeds because administrative unit scoping is not enforced is incorrect because administrative unit scoping is enforced by Microsoft Entra ID as a security boundary that restricts role permissions to the designated scope.
   • DThe password reset fails because only User Administrators can reset passwords is incorrect because Password Administrators can reset passwords within their assigned scope; the issue is the administrative unit restriction, not the role type.
10. Question 10Implement and Manage Virtual NetworkingSelect all that apply

    You have the Network Watcher connectivity test results shown in the table. You need to identify which TWO statements correctly describe the network configuration. Each correct answer presents a complete solution.

    • AVM-Web1 has no outbound internet access on port 443
    • BVM-Web1 can reach VM-DB1 on port 1433
    • CVM-App1 has network connectivity to both VM-DB1 and the internetCorrect
    • DAll VMs are in the same VNet
    • EVM-Web1 cannot directly access the database tierCorrect
    ✓ Correct answer: C, E

    From the Network Watcher test results, Test-3 shows VM-App1 can reach VM-DB1 on port 1433 (Reachable), and Test-5 shows VM-App1 can reach the internet on port 443 (Reachable). This confirms that VM-App1 has connectivity to both the database tier and the internet. Test-2 shows VM-Web1 cannot reach VM-DB1 on port 1433 (Unreachable), confirming that the web tier cannot directly access the database tier. This is a common network segmentation pattern where the web tier communicates with the application tier, and only the application tier communicates with the database tier.

    Why the other options are wrong

    • AVM-Web1 has no outbound internet access on port 443 is incorrect because while Test-4 confirms this, it only restates a single test result rather than describing a broader network configuration pattern.
    • BVM-Web1 can reach VM-DB1 on port 1433 is incorrect because Test-2 explicitly shows this connection as Unreachable.
    • DAll VMs are in the same VNet is incorrect because VM-DB1 is in a 10.2.x.x address range while the other VMs are in 10.1.x.x, suggesting they may be in different VNets connected via peering.

Who this AZ-104 practice exam is for

This practice set is for anyone preparing for the AZ-104: Microsoft Azure Administrator exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this AZ-104 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real AZ-104 exam.

Related Microsoft resources

• AZ-104 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Best AZ-104 Practice Exams (2026)Comparison
• Best AZ-900 Practice Exams (2026)Comparison
• AZ-104 vs AZ-305Comparison
• AZ-900 vs AZ-104Comparison
• Manage Azure Identities and Governance practice questions225 questions
• Implement and Manage Storage practice questions195 questions
• Deploy and Manage Azure Compute Resources practice questions200 questions
• Implement and Manage Virtual Networking practice questions194 questions
• Monitor and Maintain Azure Resources practice questions142 questions
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• AZ-140 practice examRelated
• AZ-305 practice examRelated
• AZ-400 practice examRelated

AZ-104 practice exam FAQ