The AZ-104 Azure Administrator certification is one of the most sought-after credentials for cloud professionals. Unlike AZ-900, this is an Associate-level exam that tests your practical ability to manage Azure resources across identity, governance, storage, compute, and virtual networking.
These 25 free practice questions are scenario-based, matching the real exam format. Each question includes detailed explanations to help you understand not just the correct answer, but the reasoning behind Azure administrative best practices.
What You'll Get:
- ✓25 practice questions across all AZ-104 exam domains
- ✓Detailed explanations for correct and incorrect answers
- ✓Real-world scenarios testing administrative skills
- ✓Coverage of VMs, networking, storage, Azure AD, and monitoring
How to Use These Practice Questions
AZ-104 is a hands-on exam. These questions simulate the scenario-based format you'll encounter:
Practice Test Instructions
- • Each question has ONE correct answer
- • Read scenarios carefully—details matter for admin tasks
- • Time yourself: 25 minutes for 25 questions
- • Review all explanations, even correct answers
Manage Azure Identities & Governance
Questions 1-6
Azure AD User Management
Your organization has 500 employees joining next month from an acquired company. All users need Azure AD accounts with the same default settings. The HR system can export user data to a CSV file with names, emails, and departments.
What is the MOST efficient way to create these user accounts?
RBAC Role Assignment
A developer needs to start, stop, and restart virtual machines in the production resource group, but should not be able to delete VMs, modify network settings, or access any other resource groups. You want to follow the principle of least privilege.
Which role should you assign at the resource group scope?
Azure Policy Implementation
Your company's compliance team requires that all Azure resources must be tagged with a "CostCenter" tag. Resources without this tag should not be deployable. You need to enforce this requirement across all subscriptions.
What should you implement?
Resource Locks
A critical production resource group contains VMs, storage accounts, and databases. You need to prevent accidental deletion of these resources, but administrators should still be able to modify configurations and settings when needed.
Which type of lock should you apply to the resource group?
Cost Management
Your Azure costs have increased unexpectedly. You need to identify which resource group is consuming the most resources this month and set up alerts if spending exceeds $5,000 in any resource group.
Which tool should you use?
Azure AD Groups
You need to create a group that automatically includes all users from the Marketing department based on their department attribute in Azure AD. When users join or leave the Marketing department, group membership should update automatically.
Which type of Azure AD group should you create?
Ready for AZ-104?
Access hundreds of advanced practice questions covering all Azure Administrator topics.
Start Free PracticeImplement & Manage Storage
Questions 7-12
Storage Account Performance Tiers
Your company is deploying a high-performance database that requires low-latency storage with consistent sub-millisecond response times. The database will handle thousands of small random I/O operations per second.
Which storage account performance tier should you use?
Blob Access Tiers
You have 10 TB of log files that must be retained for 7 years for compliance. The logs are rarely accessed after 30 days but must be available within hours if needed. You want to minimize storage costs.
Which blob access tier should you configure for these log files after 30 days?
Azure Files Integration
Your company has multiple on-premises Windows servers that need to access a shared file system in Azure. Users should be able to map a network drive using SMB protocol and access files as if they were on a local file server.
Which Azure storage solution should you implement?
Storage Replication
You need to configure a storage account that can survive a regional disaster. If the primary region becomes unavailable, your application must be able to fail over to a secondary region with read access to the data.
Which replication option should you configure?
Azure Backup Configuration
You need to implement a backup solution for 50 Azure VMs. Backups should be retained for 30 days, with the ability to restore individual files or the entire VM. The solution must be centrally managed and meet compliance requirements.
Which Azure service should you use?
Shared Access Signatures (SAS)
You need to provide a third-party vendor temporary access to upload files to a specific blob container. The access should expire after 48 hours and only allow write operations to that container, with no access to other containers.
What should you create?
Deploy & Manage Compute Resources
Questions 13-18
VM Availability Sets
You're deploying a web application across multiple VMs in the same Azure region. The application must remain available during planned maintenance events, and you need to protect against rack-level failures within the datacenter.
What should you configure?
Virtual Machine Scale Sets
Your application experiences predictable traffic spikes every weekday from 9 AM to 5 PM. You need to automatically scale from 2 VM instances during off-hours to 10 instances during peak hours based on CPU utilization above 70%.
What should you implement?
Azure App Service Plans
You're migrating a .NET web application to Azure App Service. The app requires custom SSL certificates, custom domain names, and the ability to scale up to 10 instances. Development and staging slots are also required.
Which App Service plan tier should you choose?
Azure Container Instances
You need to run a containerized batch job that processes data files uploaded to blob storage. The job runs for 10-15 minutes and should start automatically when files are uploaded. You want to minimize costs and avoid managing infrastructure.
Which solution should you implement?
VM Disk Configuration
You're deploying a SQL Server VM that requires high IOPS and low latency for the database files. The VM will host a production database with thousands of transactions per second. Cost is a secondary concern to performance.
Which disk type should you use for the database data files?
VM Extensions
After deploying 20 Windows VMs, you need to install and configure the Microsoft Monitoring Agent on all of them to enable Azure Monitor. You want to automate this process and ensure consistent configuration.
What should you use?
Configure & Manage Virtual Networking
Questions 19-25
Virtual Network Peering
You have two virtual networks in the same Azure region: VNet1 (10.1.0.0/16) and VNet2 (10.2.0.0/16). Resources in VNet1 need to communicate with resources in VNet2 using private IP addresses with low latency.
What should you configure?
Network Security Groups (NSG)
You need to allow inbound HTTPS traffic (port 443) from the internet to web servers in a subnet, but block all other inbound traffic. Outbound internet access should be allowed for Windows updates.
What should you configure?
Azure Load Balancer
You have three web servers in an availability set that need to distribute HTTP traffic evenly. If a server fails health checks, traffic should be routed only to healthy servers. The load balancer must handle internal traffic only.
Which load balancer should you deploy?
VPN Gateway Configuration
Your company needs a secure connection between the on-premises datacenter and Azure VNet. The connection requires IPsec/IKE VPN tunnel with up to 1.25 Gbps throughput and must support multiple site-to-site connections.
Which VPN Gateway SKU should you choose?
Azure DNS
You've registered the domain contoso.com with a third-party registrar. You want to host the DNS zone in Azure to manage DNS records for web apps and VMs. Users worldwide should resolve the domain to Azure resources.
What should you do?
Service Endpoints
VMs in your Azure VNet need to access an Azure Storage account. You want to ensure traffic stays on the Microsoft backbone network and doesn't traverse the public internet. The storage account should only be accessible from your VNet.
What should you configure?
Network Watcher
You're troubleshooting connectivity issues between a VM in Azure and an on-premises server. You need to verify if packets are being dropped and identify which network security rules are blocking traffic.
Which Network Watcher feature should you use?
Answer Key with Detailed Explanations
Review each explanation carefully, even for questions you answered correctly
Scoring Guide for AZ-104
- • 20-25 correct: Strong foundation. Continue with full practice exams
- • 15-19 correct: Good progress. Review weak domains
- • 10-14 correct: More hands-on practice needed
- • Below 10: Focus on fundamentals and Azure portal experience
Question 1: Azure AD User Management
Correct Answer: B) Use Azure AD bulk operations to import users from CSV
Why this is correct:
Azure AD bulk operations allow you to import hundreds or thousands of users efficiently from a CSV file through the Azure portal. This feature validates the data, shows you any errors before committing, and processes all users in a single operation. It's the most efficient method for this scenario since you already have the CSV export from HR.
Why other answers are incorrect:
Question 2: RBAC Role Assignment
Correct Answer: C) Virtual Machine Operator
Why this is correct:
The Virtual Machine Operator role is designed specifically for this scenario. It allows users to start, stop, and restart VMs, but doesn't grant permissions to delete VMs, modify networking, or manage other resource types. This follows the principle of least privilege by providing exactly the permissions needed, nothing more.
Why other answers are incorrect:
Question 3: Azure Policy Implementation
Correct Answer: B) Azure Policy with "Deny" effect for resources without CostCenter tag
Why this is correct:
Azure Policy with a "Deny" effect is the correct solution for enforcing compliance requirements. You can create a policy that requires the CostCenter tag and prevents deployment of any resource that doesn't include it. Policies can be assigned at the subscription or management group level to enforce across all subscriptions.
Why other answers are incorrect:
Question 4: Resource Locks
Correct Answer: B) CanNotDelete lock
Why this is correct:
CanNotDelete lock prevents deletion of resources but still allows modifications and configuration changes. This meets both requirements: protecting against accidental deletion while allowing administrators to update settings, resize VMs, modify database configurations, etc. The lock applies to all resources within the resource group.
Why other answers are incorrect:
Question 5: Cost Management
Correct Answer: B) Azure Cost Management + Billing
Why this is correct:
Azure Cost Management + Billing provides comprehensive cost analysis, allowing you to break down spending by resource group, service, tag, and time period. You can create budgets with alerts that notify you when spending exceeds thresholds (like $5,000). It's the dedicated tool for cost tracking and budget management in Azure.
Why other answers are incorrect:
Question 6: Azure AD Groups
Correct Answer: C) Security group with Dynamic User membership
Why this is correct:
Security groups with Dynamic User membership use rules to automatically add or remove members based on user attributes. You can create a rule like "user.department -eq 'Marketing'" to automatically populate the group. As users' department attributes change, group membership updates automatically without manual intervention.
Why other answers are incorrect:
Question 7: Storage Account Performance Tiers
Correct Answer: B) Premium performance with SSD-based storage
Why this is correct:
Premium performance storage accounts use SSD-based storage and are specifically designed for high-performance scenarios requiring low latency and high IOPS. They provide consistent sub-millisecond response times and are ideal for databases with thousands of small random I/O operations per second. This is the recommended tier for production databases.
Why other answers are incorrect:
Question 8: Blob Access Tiers
Correct Answer: B) Cool tier
Why this is correct:
Cool tier is optimized for data that is infrequently accessed but must remain readily available (within milliseconds to hours). It offers lower storage costs than Hot tier while maintaining reasonable access speeds. For compliance data retained 7 years but rarely accessed after 30 days, Cool tier provides the best balance of cost and availability.
Why other answers are incorrect:
Question 9: Azure Files Integration
Correct Answer: B) Azure Files with SMB protocol
Why this is correct:
Azure Files provides fully managed file shares in the cloud accessible via SMB protocol. Windows servers can mount Azure file shares as network drives using standard SMB protocol, just like traditional on-premises file servers. This provides seamless integration with existing Windows applications and workflows.
Why other answers are incorrect:
Question 10: Storage Replication
Correct Answer: D) Read-access geo-redundant storage (RA-GRS)
Why this is correct:
RA-GRS replicates data to a secondary region hundreds of miles away from the primary region. Crucially, it provides read access to the data in the secondary region at all times, even before a failover. This meets both requirements: regional disaster protection and the ability to read data from the secondary region if the primary becomes unavailable.
Why other answers are incorrect:
Question 11: Azure Backup Configuration
Correct Answer: C) Recovery Services vault with Azure Backup
Why this is correct:
Recovery Services vault with Azure Backup is the native Azure solution for VM backups. It provides centralized backup management, configurable retention policies (30 days in this case), and supports both item-level recovery (individual files) and full VM recovery. It also meets compliance requirements with built-in policies and reporting.
Why other answers are incorrect:
Question 12: Shared Access Signatures (SAS)
Correct Answer: B) Container-level SAS with write permission and 48-hour expiry
Why this is correct:
A container-level SAS token provides granular access to a specific container only. You can configure it with write permission, 48-hour expiration, and no access to other containers. This follows the principle of least privilege by granting exactly the access needed for the vendor to upload files, nothing more.
Why other answers are incorrect:
Question 13: VM Availability Sets
Correct Answer: A) Deploy VMs in an availability set with 2 fault domains and 5 update domains
Why this is correct:
Availability sets with fault domains and update domains are specifically designed for this scenario. Fault domains protect against rack-level failures (power, network) by spreading VMs across different physical racks. Update domains ensure VMs are rebooted in batches during planned maintenance, keeping the application available. This configuration provides 99.95% SLA.
Why other answers are incorrect:
Question 14: Virtual Machine Scale Sets
Correct Answer: A) Virtual Machine Scale Set with autoscale rules based on CPU metrics
Why this is correct:
VM Scale Sets are designed specifically for autoscaling scenarios. You can configure rules to automatically scale out when CPU exceeds 70% and scale in when demand decreases. Scale sets support both metric-based (CPU, memory) and schedule-based scaling rules, making them perfect for predictable traffic patterns with variable load.
Why other answers are incorrect:
Question 15: Azure App Service Plans
Correct Answer: C) Standard (S1)
Why this is correct:
Standard tier is the minimum tier that supports deployment slots (needed for dev/staging), custom domains, and SSL certificates. It supports scaling up to 10 instances and provides all the features required in the scenario. Standard offers a good balance of features and cost for production workloads that don't require Premium features.
Why other answers are incorrect:
Question 16: Azure Container Instances
Correct Answer: B) Azure Container Instances triggered by Azure Functions
Why this is correct:
Azure Container Instances (ACI) provides on-demand containers with per-second billing, perfect for short-running batch jobs. Azure Functions can be triggered by blob storage events (file uploads) and then start ACI containers to process the files. You only pay for the compute time used (10-15 minutes), with no infrastructure management required.
Why other answers are incorrect:
Question 17: VM Disk Configuration
Correct Answer: D) Ultra Disk
Why this is correct:
Ultra Disk provides the highest performance tier with sub-millisecond latency and up to 160,000 IOPS per disk. It's specifically designed for I/O-intensive workloads like SQL Server production databases handling thousands of transactions per second. While it's the most expensive option, the scenario states "cost is a secondary concern to performance."
Why other answers are incorrect:
Question 18: VM Extensions
Correct Answer: B) Azure VM extension for Microsoft Monitoring Agent
Why this is correct:
VM extensions are small applications that provide post-deployment configuration and automation on Azure VMs. The Microsoft Monitoring Agent extension can be deployed to multiple VMs simultaneously with consistent configuration, either through the portal, PowerShell, or ARM templates. This ensures automation and consistency across all 20 VMs.
Why other answers are incorrect:
Question 19: Virtual Network Peering
Correct Answer: B) Virtual network peering between VNet1 and VNet2
Why this is correct:
Virtual network peering connects two Azure VNets directly through the Microsoft backbone network, allowing resources to communicate using private IP addresses. Peering provides low latency (same as within a single VNet), high bandwidth, and doesn't require gateways or encryption overhead. It's the simplest and most performant solution for VNet-to-VNet connectivity in the same or different regions.
Why other answers are incorrect:
Question 20: Network Security Groups
Correct Answer: A) NSG with inbound rule allowing port 443 and default outbound rules
Why this is correct:
NSGs are perfect for this scenario. Create an inbound security rule to allow port 443 (HTTPS) from the internet, and NSG's default outbound rules allow all outbound traffic (including Windows updates). NSGs deny all inbound traffic by default, so you only need to explicitly allow port 443. This is the simplest, most cost-effective solution.
Why other answers are incorrect:
Question 21: Azure Load Balancer
Correct Answer: B) Internal Azure Load Balancer (Standard SKU)
Why this is correct:
Internal Load Balancer distributes traffic within a VNet (not from the internet), perfect for internal-only traffic. Standard SKU provides health probes to monitor server health and automatically routes traffic only to healthy instances. It supports availability sets and provides the 99.99% SLA needed for production workloads.
Why other answers are incorrect:
Question 22: VPN Gateway Configuration
Correct Answer: C) VpnGw2
Why this is correct:
VpnGw2 supports up to 1.25 Gbps throughput and allows up to 30 site-to-site/VNet-to-VNet tunnels. It provides the bandwidth required and supports multiple site-to-site connections. VpnGw2 also includes features like BGP support and active-active configurations for production scenarios.
Why other answers are incorrect:
Question 23: Azure DNS
Correct Answer: A) Create an Azure DNS zone for contoso.com and update the domain's nameservers at the registrar
Why this is correct:
Azure DNS provides reliable, secure DNS hosting with global reach. Create a DNS zone for contoso.com in Azure, then update the nameserver (NS) records at your domain registrar to point to Azure's DNS nameservers. This delegates DNS management to Azure while keeping the domain registration with the original registrar. Azure DNS will then resolve queries globally.
Why other answers are incorrect:
Question 24: Service Endpoints
Correct Answer: B) Service endpoint for Microsoft.Storage on the subnet and storage firewall rules
Why this is correct:
Service endpoints extend your VNet's private address space to Azure services over the Microsoft backbone network. Enable the Microsoft.Storage service endpoint on your subnet, then configure the storage account firewall to only allow access from that subnet. Traffic stays on Microsoft's network and the storage account is secured to your VNet only.
Why other answers are incorrect:
Question 25: Network Watcher
Correct Answer: B) IP Flow Verify
Why this is correct:
IP Flow Verify tests whether a packet is allowed or denied to/from a VM based on 5-tuple information (source/destination IP, port, protocol). It tells you exactly which security rule is allowing or blocking traffic and shows whether packets would be dropped. This is perfect for troubleshooting connectivity issues and identifying blocking NSG rules.
Why other answers are incorrect:
Frequently Asked Questions
How difficult is AZ-104 compared to AZ-900?
AZ-104 is significantly more challenging. It is an Associate-level certification requiring hands-on Azure administration experience. Questions are scenario-based and test your ability to implement and manage resources.
Do I need hands-on Azure experience?
Yes. Microsoft recommends at least 6 months of hands-on Azure administration experience. The exam includes performance-based tasks requiring practical knowledge of the Azure portal, CLI, and PowerShell.
How many practice questions should I complete?
For AZ-104, practicing with 500-600 unique questions is recommended due to the exam's breadth and depth. This ensures coverage of all administrative tasks.
Can I skip AZ-900 and go straight to AZ-104?
Yes, if you have Azure experience. However, AZ-900 provides a solid foundation that is helpful for AZ-104. Many candidates take both sequentially.