• 60 questions

AZ-104 Practice Test

What an Azure administrator must do or expect: rule order, limits and defaults, each answer linked to Microsoft Learn.

How many levels of depth can a management group tree support?

Pick an answer, then press Check answer. Then you see Correct or Not quite, with the reason. Keys: A to D pick, Enter checks.

Print covers the next 50 questions. Share this set copies a link to the same questions in the same order.

Exam mode: 50 questions, 100 minutes.

More options

Unofficial practice questions, not affiliated with Microsoft Corporation. Bank checked October 10, 2026.

Next step Back to basics: Azure FundamentalsAnother IT certification? Pick it

All 60 questions

Manage Azure identities and governance 14

  • A contractor must create and manage every kind of resource in a subscription but must not grant access to anyone. Which built-in role fits? Microsoft Learn: Azure roles, Microsoft Entra roles, and classic subscription administrator roles
  • A group fills itself from the rule user.department -eq "Sales". An administrator wants to add one engineer by hand. What happens? Microsoft Learn: Manage rules for dynamic membership groups in Microsoft Entra ID
  • A license is to be assigned through a group. Some members have no location set on their accounts. Which location do they get? Microsoft Learn: Assign or unassign licenses to a group in the Microsoft 365 admin center
  • A monthly budget of $500 reaches its 100% threshold on the 20th. What happens to the running resources? Microsoft Learn: Tutorial
  • A new resource matches one policy with the deny effect and another with the audit effect. Which does Azure Policy evaluate first? Microsoft Learn: Azure Policy definitions effect basics
  • A partner's employee redeems a B2B collaboration invitation. How does that person appear in the inviting directory? Microsoft Learn: What is Microsoft Entra B2B collaboration?
Show all 60 questions (54 more)

Manage Azure identities and governance, continued

  • A ReadOnly lock is put on a storage account. Which operation does it block that might surprise an administrator? Microsoft Learn: Lock your Azure resources to protect your infrastructure
  • How many levels of depth can a management group tree support? Microsoft Learn: Organize your resources with management groups
  • In a role definition, what does the NotActions list do? Microsoft Learn: Understand Azure role definitions
  • Reader is assigned to a user at subscription scope. A resource group is created in that subscription the next day. Can the user view its resources? Microsoft Learn: Understand scope for Azure RBAC
  • The self-service password reset policy is changed to require two methods. A user has registered only a phone number. What can that user do? Microsoft Learn: Self-service password reset deep dive
  • Ten virtual machines are being moved to another resource group. During the move, what is true of the source and target resource groups? Microsoft Learn: Move Azure resources to a new resource group or subscription
  • What is the largest number of tag name-value pairs one resource group can carry? Microsoft Learn: Use tags to organize your Azure resources and management hierarchy
  • Which kind of role is used to reset user passwords and manage user licenses in a directory? Microsoft Learn: Azure roles, Microsoft Entra roles, and classic subscription administrator roles

Implement and manage storage 11

  • A 2 GB blob in the archive tier is needed within the hour. Which rehydration priority should be requested? Microsoft Learn: Blob rehydration from the archive tier
  • A lifecycle management rule is added at noon to move old blobs to the cool tier. How soon may its first run start? Microsoft Learn: Azure Blob Storage lifecycle management overview
  • A security auditor asks for server-side encryption to be switched off on one test storage account. What is the answer? Microsoft Learn: Azure Storage encryption for data at rest
  • A storage account is created with no network rules. From which networks does its public endpoint accept connections? Microsoft Learn: Azure Storage firewall rules and network access
  • A storage account uses on-premises AD DS for Azure Files access. An administrator wants Microsoft Entra Kerberos for a second share in the same account. Is that possible? Microsoft Learn: Overview
  • Before object replication can be configured, which feature must be enabled on both the source and the destination account? Microsoft Learn: Object replication overview
  • How many access keys does Azure generate when a storage account is created? Microsoft Learn: Manage account access keys
  • How many stored access policies can be set on one blob container at a time? Microsoft Learn: Define a stored access policy
  • What is an Azure Files share snapshot? Microsoft Learn: Use Azure Files Share Snapshots
  • What is the longest retention period that can be set for blob soft delete? Microsoft Learn: Soft Delete for Blobs to Recover Data
  • Which kind of shared access signature is secured with Microsoft Entra credentials and not with the account key? Microsoft Learn: Grant limited access to data with shared access signatures (SAS)

Deploy and manage Azure compute resources 14

  • A container app in Azure Container Apps scales to zero replicas overnight. What is billed for usage in those hours? Microsoft Learn: Scaling in Azure Container Apps
  • A scale set was created in Uniform orchestration mode. The team now wants Flexible. What must it do? Microsoft Learn: Orchestration modes for Virtual Machine Scale Sets in Azure
  • A staging slot is swapped into production. Which of these settings stays with its slot and is not swapped? Microsoft Learn: Set Up Staging Environments
  • A team on the Basic tier wants a staging deployment slot for its web app. What is the lowest tier that offers slots? Microsoft Learn: Set Up Staging Environments
  • A template that defines one storage account is deployed, with no mode given, to a resource group that already holds a virtual network. What happens to the virtual network? Microsoft Learn: Deployment modes
  • A virtual machine's temp disk and disk caches must be encrypted at rest. Which option covers them? Microsoft Learn: Overview of managed disk encryption options
  • An administrator changes the size of a virtual machine while it is running. What should users expect? Microsoft Learn: Resize a virtual machine
  • An app runs in the Shared tier of an App Service plan and traffic doubles. Why can the team not add instances? Microsoft Learn: Azure App Service Plans
  • An availability set has five update domains and five virtual machines. A sixth virtual machine is added. Where is it placed? Microsoft Learn: Availability sets overview
  • In Azure Container Instances, what do the containers of one container group share? Microsoft Learn: Introduction to container groups
  • In which deployment mode does Resource Manager delete resources that are in the resource group but are not in the template? Microsoft Learn: Deployment modes
  • Which Azure CLI command converts an ARM template named main.json to Bicep? Microsoft Learn: Decompile a JSON Azure Resource Manager template to Bicep
  • Which DNS record does Microsoft recommend for mapping the root domain contoso.com to an App Service app? Microsoft Learn: Set Up an Existing Custom Domain Name for Your App
  • Which of these elements must every ARM template contain? Microsoft Learn: Template structure and syntax

Implement and manage virtual networking 12

  • A health probe on an Azure Load Balancer fails for one backend virtual machine. What does the load balancer do? Microsoft Learn: Azure Load Balancer health probes
  • A hub virtual network has a VPN gateway to the office. Which peering feature lets a peered spoke network reach the office through it? Microsoft Learn: Azure Virtual Network Peering
  • A subnet is created as 10.0.1.0/24. How many of its 256 addresses can be given to resources? Microsoft Learn: Azure Virtual Network FAQ
  • A virtual network is linked to a private DNS zone with autoregistration on. A virtual machine with one network interface is deployed. What appears in the zone? Microsoft Learn: What is autoregistration feature in Azure DNS private zones?
  • All outbound traffic from a subnet must pass through a firewall that runs on a virtual machine. Which next hop type does the user-defined route name? Microsoft Learn: Azure virtual network traffic routing
  • An outbound rule allows a virtual machine to reach any address on port 80. Is an inbound rule needed for the replies? Microsoft Learn: Azure network security groups overview
  • The first network interface in an application security group is in VNet1. A second interface is in VNet2. Can it join the same group? Microsoft Learn: Azure Application Security Groups Overview
  • One network security group is on a subnet and another on a virtual machine's network interface. For inbound traffic, which rules does Azure process first? Microsoft Learn: How Network Security Groups Filter Network Traffic in Azure
  • Two rules in a network security group match the same inbound packet: priority 200 denies it and priority 300 allows it. What happens? Microsoft Learn: Azure network security groups overview
  • What is the smallest size allowed for the AzureBastionSubnet of a new Azure Bastion deployment? Microsoft Learn: About Azure Bastion configuration settings
  • Which feature connects a subnet to an Azure service over the Azure backbone without deploying a network interface for the service into the virtual network? Microsoft Learn: Azure virtual network service endpoints
  • Why can a CNAME record set not be created at the apex (@) of an Azure DNS zone? Microsoft Learn: DNS Zones and Records Overview

Monitor and maintain Azure resources 9

  • A virtual machine cannot be reached on port 443. Which Network Watcher tool checks whether a packet is allowed or denied and names the security rule responsible? Microsoft Learn: Azure Network Watcher Overview
  • How many diagnostic settings can one Azure resource have? Microsoft Learn: Diagnostic Settings in Azure Monitor
  • How often does Azure Monitor collect platform metrics from Azure resources, unless a metric's definition says otherwise? Microsoft Learn: Metrics in Azure Monitor
  • In Azure-to-Azure disaster recovery with Site Recovery, where are a virtual machine's changes held before they are sent to target storage? Microsoft Learn: Azure to Azure disaster recovery architecture in Azure Site Recovery
  • Servers are patched every Sunday night and the alerts that fire then are noise. Which Azure Monitor feature suppresses the notifications in that window? Microsoft Learn: Alert processing rules for Azure Monitor alerts
  • Two alert rules must email the same three engineers. How many action groups are needed? Microsoft Learn: Create and manage action groups in Azure Monitor
  • Virtual machines have been failed over to a secondary region with Site Recovery. Which step makes them replicate to the primary region again? Microsoft Learn: Tutorial to fail over Azure VMs to a secondary region for disaster recovery with Azure Site Recovery.
  • Which of these workloads is backed up to a Backup vault? Microsoft Learn: Overview of the Backup vaults
  • Which vault holds Azure Backup data for IaaS virtual machines and for SQL Server in Azure VMs? Microsoft Learn: Overview of Recovery Services vaults

How this list was compiled: Own questions, written to the five skill areas and weightings of the study guide Microsoft publishes for Exam AZ-104: Microsoft Azure Administrator at https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-104 (read 2026-10-10; skills measured as of April 17, 2026), with the exam time from https://learn.microsoft.com/en-us/credentials/certifications/azure-administrator/ (read 2026-10-10). Facts were read on 2026-10-10 in Microsoft's public pages at learn.microsoft.com. Each question names the page it was written from and links to it. Licence: Own work. Every question, wrong choice and explanation was written for this site from the skills listed in the study guide and the public Microsoft Learn pages named in each question. Nothing is copied or reworded from a Microsoft exam, Microsoft's Practice Assessment, a practice product or a question dump.

How it works

This unofficial AZ-104 practice test sets 60 of our own administrator scenarios under the five skill areas Microsoft publishes. It is written for this site alone and is not affiliated with Microsoft Corporation.

Read the full guide

What exam AZ-104 measures

The study guide, read on October 10, 2026, gives the skills measured as of April 17, 2026: identities and governance 20 to 25 percent, storage 15 to 20, compute 20 to 25, virtual networking 15 to 20, monitoring and maintenance 10 to 15. The certification page gives 100 minutes.

What this bank leaves out

The certification page says the exam may have interactive components. None is here: every question is multiple choice. Prices and portal click paths are left out, and limits such as tag counts are given as Microsoft Learn showed them that day.

  • A network security group stops at the first rule that matches, lowest priority number first.
  • Azure keeps five addresses in every subnet: the first four and the last.
  • Resizing a running virtual machine restarts it.

Questions and answers

How many questions are on the AZ-104 exam?

Microsoft gives no count for AZ-104. Its page on exam duration puts most certification exams between 40 and 60 questions. Exam mode on this page asks 50 in 100 minutes.

What score do you need to pass AZ-104?

The study guide says passing takes a score of 700 or more. Scores run from 1 to 1,000 and are scaled, so 700 is not the same as 70 percent right.

Can you use Microsoft Learn during the AZ-104 exam?

Yes. Microsoft's exam experience page says Learn can be opened during associate and expert exams, for questions on which you may want to look something up. It warns that looking up every answer leaves too little time.

More tests

Show 7 more

Browse Safety and Trades