Microsoft Azure Administrator (AZ-104) practice questions and exam guide

How is the AZ-104 Azure Administrator Associate exam structured?

1. Thirty questions drawn only from the identity domain, with no networking or storage content
2. Roughly forty to sixty questions in 100 minutes, passing at 700 on a 1-1000 scaled range
3. A take-home assignment submitted through Microsoft Learn and graded by a human reviewer
4. A written essay paper in which candidates describe Azure administration tasks at length
5. An oral interview with a Microsoft assessor who scores the spoken answers against a rubric

Answer: B — Roughly forty to sixty questions in 100 minutes, passing at 700 on a 1-1000 scaled range

B reflects the current exam: about forty to sixty items (Microsoft does not publish a count) in 100 minutes of testing time, passing at a scaled score of 700 on a 1-1000 range rather than 70% correct, covering identities and governance, storage, compute, virtual networking, and monitoring and maintenance. A understates both the length and the scope. C, D and E describe assessment formats Microsoft does not use for this exam, which is delivered as multiple choice, multiple response, drag-and-drop, hot area, build list and active screen items.

What is the cost difference between Azure Reserved VM Instances (1-year) and pay-as-you-go for the same VM?

1. Reserved is typically 5-10% cheaper.
2. Reserved is typically 20-40% cheaper.
3. Reserved is more expensive.
4. They are the same price.
5. Reserved requires upfront-only payment.

Answer: B — Reserved is typically 20-40% cheaper.

Azure RIs typically offer 20-40% savings over pay-as-you-go for 1-year terms (more for 3-year). Payment can be upfront or monthly. AZ-104 expects awareness of cost-optimization options.

An administrator needs a report of every resource missing an Environment tag across the whole tenant, without blocking any deployments. The MOST appropriate configuration is:

1. A policy assigned at the root management group with an audit effect on the tag
2. A policy assigned at each resource group with a deny effect on the missing tag condition
3. A budget alert that fires whenever untagged resources accrue any cost at all
4. A read-only lock at the root management group covering untagged resources

Answer: A — A policy assigned at the root management group with an audit effect on the tag

A) Correct — an audit effect assigned at the root management group evaluates the entire tenant and reports non-compliance without interfering with deployments. B) Deny would block deployments, which the requirement rules out, and per-group assignment misses new groups. C) Budgets report spend rather than tag coverage. D) Locks cannot be applied at management group scope and would not produce a tag report.

A role assignment must apply to exactly one virtual machine and must not affect its siblings in the same resource group. The assignment should be created at which scope?

1. The management group above the subscription that contains the machine
2. The subscription that contains the resource group holding the machine
3. The resource group holding the machine and its sibling resources
4. The virtual machine itself, which is the narrowest available scope

Answer: D — The virtual machine itself, which is the narrowest available scope

D) Correct — assigning at the resource is the narrowest scope available and confines the grant to that single object. A) A management group assignment reaches every subscription beneath it, which is the opposite of narrow. B) A subscription assignment reaches every resource group in it. C) A resource group assignment reaches the siblings the requirement excludes.

Which storage redundancy option combines zone redundancy in the primary region with an asynchronously replicated secondary region that applications can read from?

1. Locally redundant storage, which keeps three synchronous copies inside a single datacenter
2. Zone-redundant storage, which spreads three synchronous copies across availability zones
3. Geo-redundant storage, which pairs a single-datacenter primary with an asynchronous secondary
4. Geo-zone-redundant storage, which pairs a zone-redundant primary with an asynchronous secondary
5. Read-access geo-zone-redundant storage, which also exposes that secondary region for reads

Answer: E — Read-access geo-zone-redundant storage, which also exposes that secondary region for reads

E is the only option that has both properties the question asks for: a zone-redundant primary and a secondary copy that clients can read without a failover. D is the closest trap, as it replicates identically but keeps the secondary inaccessible until Microsoft or the customer initiates a failover. C has the readable-secondary variant too but its primary sits in one datacenter, so it is not zone redundant. A and B never leave the primary region.

A storage account has blob soft delete enabled with seven-day retention. A user deleted a blob three days ago. What can be done?

1. The blob can be listed as deleted and restored, because it is inside the retention window
2. The blob is already unrecoverable, because soft delete only protects against container deletes
3. Only Microsoft Support can recover it, using a backend restore request raised on your behalf
4. Generating a new shared access signature over the blob path will bring the deleted data back

Answer: A — The blob can be listed as deleted and restored, because it is inside the retention window

A is correct: with soft delete active, a deleted blob is retained for the configured period of one to 365 days and can be undeleted from the portal, CLI or PowerShell until that window closes. B misstates the scope; blob soft delete and container soft delete are separate settings and blob-level protection is what is enabled here. C is unnecessary, since the customer performs the restore. D confuses an authorisation token with data recovery.

Which statement about encryption of data at rest in an Azure storage account is accurate?

1. Encryption at rest is optional and must be enabled explicitly when the account is created
2. Encryption at rest applies only when a customer-managed key is supplied from Key Vault
3. Encryption at rest covers blobs and files but leaves queues and tables in clear text form
4. Encryption at rest applies automatically to all data written to the account, with no opt-out

Answer: D — Encryption at rest applies automatically to all data written to the account, with no opt-out

D) Correct — all data written to an Azure storage account is encrypted at rest by the service, and the setting cannot be turned off; the choice is only which key protects it. A) There is no create-time toggle to enable it, because it is always on. B) Customer-managed keys change key ownership; encryption is already in force with platform-managed keys. C) The coverage spans the account's data services rather than blobs and files alone.

A service SAS with a thirty-day expiry has leaked. The administrator must revoke that one token without disrupting other applications using the same account. Which prior design decision makes this possible?

1. The SAS was issued against a stored access policy on the container
2. The SAS was issued with an HTTPS-only protocol restriction applied
3. The SAS was issued with a start time set several minutes in the past
4. The SAS was issued with read and list permissions rather than write

Answer: A — The SAS was issued against a stored access policy on the container

A) Correct — a SAS tied to a stored access policy inherits its constraints from that policy, so deleting or changing the policy invalidates just those tokens while other applications continue. B) Requiring HTTPS protects the token in transit but gives no way to revoke it once leaked. C) A backdated start time avoids clock-skew failures and has nothing to do with revocation. D) Narrower permissions limit the damage but the token remains valid until it expires.

An administrator must redeploy a Bicep file that defines a storage account and a virtual network into a resource group that already contains an unrelated public IP address created by hand. The deployment must leave that public IP untouched. Which deployment mode is the MOST appropriate?

1. Incremental mode, which adds or updates the declared resources and leaves undeclared ones alone
2. Complete mode, which reconciles the whole group so that only the resources declared in the template remain
3. Validate-only mode, which checks the template syntax but never commits any of the changes
4. Subscription-scope mode, which is required whenever a resource group holds manual resources

Answer: A — Incremental mode, which adds or updates the declared resources and leaves undeclared ones alone

A) Correct — incremental is the default mode and only creates or updates resources declared in the template; anything else already in the resource group is preserved. B) Complete mode tempts because it sounds thorough, but it deletes resources in the group that are not in the template, which would remove the public IP. C) There is no commit-free deployment mode; what-if and validate are separate operations, not modes. D) Deployment scope and deployment mode are independent settings, and manual resources have no bearing on scope.

A virtual machine scale set is set to manual scaling with a capacity of 10. Autoscale rules would scale it to 15. What happens?

1. The autoscale rules are not evaluated, because manual scaling and autoscale are exclusive
2. The scale set grows to 15 instances, because autoscale always overrides a manual capacity
3. The scale-out attempt fails silently and an error is written to the scale set's activity log
4. Both modes stay active, so the instance count oscillates between the two configured values

Answer: A — The autoscale rules are not evaluated, because manual scaling and autoscale are exclusive

A is correct: a scale set uses either manual capacity or an autoscale setting, and choosing manual means the autoscale configuration is not in effect, so the count stays where you put it. B assumes autoscale wins a contest that never happens. C imagines a failed evaluation rather than no evaluation. D describes an oscillation that the mutually exclusive design exists to prevent.

A Bicep file deploys a virtual machine but the adminPassword parameter is not decorated with @secure(). What is the risk?

1. There is no risk, because Resource Manager always redacts parameter values that hold secrets
2. The supplied password is stored in clear text in the deployment history and in the logs
3. The deployment fails validation, because password parameters must always carry a decorator
4. The password is encrypted automatically using a platform key, so no action is needed at all

Answer: B — The supplied password is stored in clear text in the deployment history and in the logs

B is the exposure: Resource Manager keeps the parameter values it was given as part of the deployment record, and only the @secure() decorator stops the value being returned or logged. A and D both assume an automatic protection that only the decorator provides. C is wrong because the template deploys perfectly well without the decorator, which is exactly why the mistake goes unnoticed. Referencing the secret from a key vault is the stronger pattern.

An administrator deploys a template that defines a VM. The deployment fails partway through and some resources were already created. Which statement about resource groups and deployments is accurate?

1. A failed deployment automatically rolls back every resource it created in that run
2. The deployment history is deleted whenever a deployment reports a failed state
3. Resources created before the failure remain, and the deployment can be corrected and rerun
4. A failed deployment places the whole resource group into a read-only state until it is cleared

Answer: C — Resources created before the failure remain, and the deployment can be corrected and rerun

C) Correct — deployments are not transactional by default; already-created resources persist, and rerunning a corrected template in incremental mode converges the group to the desired state. A) Rollback to a previous successful deployment is an opt-in behaviour, not the default. B) Deployment history is retained and is the main troubleshooting artefact after a failure. D) No read-only state is applied; only resource locks produce that behaviour.

An administrator needs to give an Azure Container Instances deployment access to a private registry image, avoiding stored registry passwords. Which approach is the MOST appropriate?

1. Make the registry repository publicly readable so no credential is required at pull
2. Store the registry admin username and password as secure environment variables
3. Assign a managed identity to the container group and grant it the pull role on the registry
4. Embed a registry access token inside the container image so that the pull authenticates itself

Answer: C — Assign a managed identity to the container group and grant it the pull role on the registry

C) Correct — a managed identity with the registry pull role authenticates without any secret being stored or rotated by the administrator. B) Admin credentials work but are exactly the stored password the requirement rules out, and the admin account is discouraged. A) Making a private registry public removes the security control rather than solving the credential problem. D) An image cannot authenticate its own pull, and baking credentials into an image is a leak waiting to happen.

An administrator needs the App Service backup feature to capture both the application content and its linked database on a schedule. Which statement is accurate?

1. Backups are available on every plan tier, including the free and the shared offerings
2. Backups can only be restored to a brand new app, never over the existing one
3. The backup is written to a storage account container in the same subscription
4. The database is always included automatically, with no configuration required

Answer: C — The backup is written to a storage account container in the same subscription

C) Correct — App Service backups are stored in a container in a storage account you nominate, and that account must be reachable by the app. A) Backup requires a higher tier; the free and shared tiers do not offer it. D) Linked databases are included only when explicitly configured in the backup settings. B) Restores can overwrite the existing app or target a different one, so the restriction is invented.

An App Service web app must serve several custom subdomains under one certificate, and the administrator wants the platform to issue and renew that certificate at no extra charge. Which option should be considered FIRST, and what is its main constraint?

1. An uploaded certificate from a third-party authority, which the platform then renews automatically
2. An App Service certificate purchase, which is free for wildcard subject names
3. A self-signed certificate, which browsers accept once the domain is verified
4. An App Service managed certificate, which has restrictions on wildcard and naked domain support

Answer: D — An App Service managed certificate, which has restrictions on wildcard and naked domain support

D) Correct — the free managed certificate is the first option to evaluate, but it carries feature restrictions, so multi-subdomain coverage may force a purchased or uploaded certificate instead. A) Uploaded third-party certificates must be renewed and re-uploaded by the owner. B) App Service certificates are a paid purchase, so the free requirement is not met. C) Self-signed certificates are rejected by browsers regardless of domain verification.

A web app on an App Service plan is running out of memory per request, though the number of concurrent users is stable and low. Which action addresses the problem MOST directly?

1. Scale up the plan to a tier with more memory per instance
2. Scale out the plan by adding more instances of the same size
3. Add a deployment slot and swap it to refresh the worker processes
4. Enable Always On so the application is not unloaded between requests

Answer: A — Scale up the plan to a tier with more memory per instance

A) Correct — scaling up changes the size of each worker, which is the answer when a single instance lacks resources rather than when there are too many requests. B) Scaling out multiplies instances and helps with concurrency, but each instance still has the same insufficient memory. C) A slot swap restarts the app and may mask the symptom briefly; it changes no resource limit. D) Always On prevents idle unloading and does not add memory.

Which Network Watcher feature records actual traffic from inside a VM for later offline analysis?

1. IP flow verify, which evaluates NSG rules for one described flow.
2. Next hop, which returns the route chosen for a destination address.
3. Packet capture, which records traffic to a storage account or disk.
4. Connection monitor, which tracks reachability and latency over time.

Answer: C — Packet capture, which records traffic to a storage account or disk.

C is right because packet capture uses the network watcher agent extension on the VM to record sessions, with filters and size or time limits, writing the capture file to a storage account or the VM disk. A evaluates configuration rather than observing traffic, so it never produces packets. B answers a routing question by returning the next hop type and IP for a destination. D continuously tests reachability and latency between endpoints, which is monitoring rather than packet-level evidence.

Your VNet has address space 10.0.0.0/16. Which subnet range is VALID?

1. 10.0.0.0/24
2. 10.1.0.0/24
3. 192.168.1.0/24
4. 172.16.0.0/24
5. 10.0.0.0/15

Answer: A — 10.0.0.0/24

Subnets must fit WITHIN the VNet's address space. 10.0.0.0/16 covers 10.0.0.0-10.0.255.255. B (10.0.0.0/24) fits. A is outside (10.1.x.x); C and D are different RFC1918 ranges entirely; E is larger than the VNet.

A subnet 10.0.1.0/24 is created in a VNet. How many usable host IPs are available?

1. 256
2. 254
3. 251
4. 250

Answer: C — 251

Azure reserves 5 IPs per subnet: network, default gateway, two DNS, and broadcast. /24 = 256 - 5 = 251 usable. Off-by-one trap: candidates use standard subnetting math (254) forgetting Azure's extra reservations.

You are deploying Azure Bastion into an existing virtual network. What must the subnet that hosts it be called?

1. AzureBastion, a name the portal assigns by itself while the host is being provisioned
2. BastionSubnet, which has to be a /27 or larger before the deployment will be accepted
3. AzureBastionSubnet, which has to be a /26 or larger for the host to deploy
4. GatewaySubnet, the reserved name used for virtual network gateway deployments
5. Any name at all, provided the subnet carries no network security group of its own

Answer: C — AzureBastionSubnet, which has to be a /26 or larger for the host to deploy

C gives both requirements the platform enforces: the subnet must be named AzureBastionSubnet exactly and must be at least a /26 so the host's scale units have address space. A and B are near-miss names, and a wrong name causes the deployment to fail rather than to be corrected automatically. D is the equally reserved name used by a different resource type, which makes it a plausible-looking swap. E is wrong because the name is validated, though a suitably permissive security group is also allowed on the subnet.

Before a real regional failover, a team wants to validate that replicated virtual machines boot and that the application works, with no effect on production replication. What should they do?

1. Perform a planned failover into an isolated network and then fail back afterwards
2. Perform an unplanned failover during a maintenance window and then commit it
3. Perform a test failover into an isolated network, then clean up the test resources
4. Disable replication briefly and start the replica machines directly in the target region

Answer: C — Perform a test failover into an isolated network, then clean up the test resources

C) Correct — test failover creates a copy of the replicated machines in an isolated network for validation while ongoing replication continues undisturbed, and the cleanup action removes the test resources. A) A planned failover moves the real workload and interrupts production. B) An unplanned failover is for disaster conditions and also moves the workload. D) Disabling replication discards the protection state and defeats the purpose of the rehearsal.

Activity logs from 50 subscriptions must be forwarded to a central SIEM. What is the best approach?

1. Configure the diagnostic setting by hand in each of the subscriptions.
2. Rely on Microsoft Sentinel to collect the logs without any settings.
3. Schedule a PowerShell script that recreates the settings periodically.
4. Assign an Azure Policy with deployIfNotExists to configure them centrally.

Answer: D — Assign an Azure Policy with deployIfNotExists to configure them centrally.

D is right because a policy assigned at the management group level deploys the diagnostic setting to every subscription in scope, reports compliance and remediates new subscriptions automatically. A works but does not scale and silently drifts as subscriptions are added. B is half right: Sentinel is a plausible destination, yet something still has to create the diagnostic setting that feeds it. C reinvents remediation in script form, adding a scheduling dependency and credentials with no compliance reporting.

A VM's memory and process data do not appear in Azure Monitor. What is the most likely cause?

1. The virtual machine sits in a region without metric collection.
2. The virtual machine has no public IP address assigned to its NIC.
3. A network security group is blocking the metric upload traffic.
4. Guest metrics need the Azure Monitor Agent and a collection rule.

Answer: D — Guest metrics need the Azure Monitor Agent and a collection rule.

D is right because platform metrics such as host CPU and disk operations are emitted by the hypervisor with no agent, while anything measured inside the operating system requires an agent and a data collection rule targeting it. A invents a regional gap in the metrics platform. B assumes agents need inbound internet reachability, when they make outbound connections and can use private links. C is worth checking in locked-down environments but is far less common than simply never deploying the agent.

Network Watcher's NSG Flow Logs version 2 stores data where?

1. Log Analytics workspace.
2. Event Hubs.
3. Application Insights.
4. Azure Storage account.

Answer: D — Azure Storage account.

NSG Flow Logs (v1 + v2) export to a STORAGE ACCOUNT. Traffic Analytics layers on top using Log Analytics. Right-destination trap: candidates pick Log Analytics directly.

RBAC scope hierarchy?

Management group → Subscription → Resource group → Resource. Permissions inherit down.

Storage account firewall and virtual network settings?

Public network access can be denied by default and then opened selectively. • You can allow specific virtual network subnets, public IP ranges, or trusted Azure services. • Passing the network check does not authorize the request; a key, SAS or Microsoft Entra identity still must.

List the Azure Storage redundancy options and state what failure each survives.

LRS keeps three copies in one datacenter and survives disk or rack failure • ZRS spreads copies across three availability zones in one region and survives a zone outage • GRS adds an asynchronous copy in the paired region and survives a regional outage • GZRS combines zone redundancy in the primary with the paired-region copy. RA-GRS and RA-GZRS add read access to the secondary endpoint.

Storage encryption?

Always encrypted at rest (Microsoft-managed keys default). Customer-managed keys via Key Vault.

Bastion?

Browser-based RDP/SSH to VMs. No public IPs needed on VMs.

What does encryption at host protect, and how does it differ from Azure Disk Encryption?

Encryption at host encrypts data in the temporary disk and in the disk and cache flows on the host machine itself before it reaches storage, so nothing is ever written unencrypted to the Azure Storage layer. Azure Disk Encryption instead runs inside the guest operating system using BitLocker or DM-Crypt. Encryption at host is enabled per subscription feature and per virtual machine, and requires supported sizes.