Identities and Governance — Microsoft Azure Administrator AZ-104 practice questions

A Microsoft Cost Management budget triggers an action group. Which targets can that action group invoke?

1. Email and SMS notifications only, with no automation targets at all.
2. Email, SMS, voice, webhook, ITSM, Logic App, Function and runbook.
3. Logic Apps only, invoked through the workflow's HTTP trigger URL.
4. Azure Functions only, invoked through the function's HTTP trigger.

Answer: B — Email, SMS, voice, webhook, ITSM, Logic App, Function and runbook.

B is right because an action group is a reusable collection of notification and action targets, and a budget alert can drive any of them, which is how teams stop non-production spend automatically. A is the narrow view that treats action groups as a notification list only. C and D each pick one real automation target and wrongly exclude the rest; both are supported, alongside webhooks and ITSM connectors.

A policy assignment requires a diagnostic setting on every storage account. Existing accounts show as non-compliant but nothing is being fixed. Which policy effect is REQUIRED for the assignment to correct them through a remediation task?

1. Deny, which stops any further non-compliant accounts from being created
2. Audit, which records the non-compliant accounts in the compliance report
3. Disabled, which suspends evaluation while the accounts are being corrected
4. DeployIfNotExists, which deploys the missing setting to existing accounts

Answer: D — DeployIfNotExists, which deploys the missing setting to existing accounts

D) Correct — DeployIfNotExists runs a template against non-compliant resources and is one of the two effects, with Modify, that remediation tasks can act on. A) Deny blocks new non-compliant resources but never changes anything that already exists. B) Audit is exactly what is happening now: it flags non-compliance without correcting it. C) Disabled turns the assignment off and stops even the reporting.

A guest user invited from another Microsoft Entra tenant needs access to a resource group. In which directory is the RBAC role assignment created?

1. In the hosting tenant, at the resource group that the guest needs to work with
2. In the guest's home tenant, where the user object was originally created and licensed
3. In both tenants at once, because the assignment must be matched on each side to work
4. Nowhere; the guest instead receives the Global Administrator role in the hosting tenant

Answer: A — In the hosting tenant, at the resource group that the guest needs to work with

A is correct because inviting an external user creates a guest object in the hosting tenant's directory, and role assignments for Azure resources are always made in the tenant that owns the subscription, at the scope required. B reverses the direction of the trust. C invents a reciprocal assignment. D confuses a resource-scoped role with a directory role, and Global Administrator would be a serious over-grant.

How is the AZ-104 Azure Administrator Associate exam structured?

1. Thirty questions drawn only from the identity domain, with no networking or storage content
2. Roughly forty to sixty questions in 100 minutes, passing at 700 on a 1-1000 scaled range
3. A take-home assignment submitted through Microsoft Learn and graded by a human reviewer
4. A written essay paper in which candidates describe Azure administration tasks at length
5. An oral interview with a Microsoft assessor who scores the spoken answers against a rubric

Answer: B — Roughly forty to sixty questions in 100 minutes, passing at 700 on a 1-1000 scaled range

B reflects the current exam: about forty to sixty items (Microsoft does not publish a count) in 100 minutes of testing time, passing at a scaled score of 700 on a 1-1000 range rather than 70% correct, covering identities and governance, storage, compute, virtual networking, and monitoring and maintenance. A understates both the length and the scope. C, D and E describe assessment formats Microsoft does not use for this exam, which is delivered as multiple choice, multiple response, drag-and-drop, hot area, build list and active screen items.

A role assignment must apply to exactly one virtual machine and must not affect its siblings in the same resource group. The assignment should be created at which scope?

1. The management group above the subscription that contains the machine
2. The subscription that contains the resource group holding the machine
3. The resource group holding the machine and its sibling resources
4. The virtual machine itself, which is the narrowest available scope

Answer: D — The virtual machine itself, which is the narrowest available scope

D) Correct — assigning at the resource is the narrowest scope available and confines the grant to that single object. A) A management group assignment reaches every subscription beneath it, which is the opposite of narrow. B) A subscription assignment reaches every resource group in it. C) A resource group assignment reaches the siblings the requirement excludes.

A user account was deleted three days ago and the person is returning. The MOST direct way to restore access is to:

1. Create a new account with the same user principal name and re-add all group memberships
2. Restore the object from the deleted users list in the Microsoft Entra admin center
3. Restore the account from the subscription's most recent Recovery Services vault backup
4. Raise a support request, because directory deletions take effect immediately and are final

Answer: B — Restore the object from the deleted users list in the Microsoft Entra admin center

B) Correct — a soft-deleted user sits in the deleted users list for a limited retention window and can be restored with its object identifier, memberships and licenses intact. A) A rebuilt account has a new object identifier, so group memberships, role assignments and resource access must all be redone. C) Recovery Services vaults protect workloads such as virtual machines and file shares, not directory objects. D) Deletion is soft rather than immediate and permanent, so no support request is needed inside the window.

A partner firm's staff must open an internal Azure-hosted application. The partner already has its own Microsoft Entra tenant. The administrator wants the partners to sign in with existing credentials and wants to avoid managing passwords for them. The BEST approach is to:

1. Invite each partner as a guest user in the home tenant and assign the application role to them
2. Create cloud-only member accounts for each partner and share the initial passwords securely
3. Extend the on-premises Windows Server Active Directory forest with a trust to the partner forest
4. Add the partner tenant as a subscription owner so its users inherit access to the application

Answer: A — Invite each partner as a guest user in the home tenant and assign the application role to them

A) Correct — a guest invitation creates a reference to the partner's own identity, so authentication happens in their home tenant and the host never issues or manages a credential. B) Member accounts work but defeat the requirement: the host now owns passwords and lifecycle for external people. C) A forest trust is an on-premises construct and does not grant access to an application registered in a Microsoft Entra tenant. D) Ownership of a subscription is not how application sign-in works, and it would grant sweeping resource rights rather than one app role.

What is the cost difference between Azure Reserved VM Instances (1-year) and pay-as-you-go for the same VM?

1. Reserved is typically 5-10% cheaper.
2. Reserved is typically 20-40% cheaper.
3. Reserved is more expensive.
4. They are the same price.
5. Reserved requires upfront-only payment.

Answer: B — Reserved is typically 20-40% cheaper.

Azure RIs typically offer 20-40% savings over pay-as-you-go for 1-year terms (more for 3-year). Payment can be upfront or monthly. AZ-104 expects awareness of cost-optimization options.

A resource has a 'ReadOnly' lock applied. Which action is BLOCKED?

1. Reading the resource's properties via the portal.
2. Listing the resource in a subscription query.
3. Updating a tag on the resource.
4. Assigning RBAC roles to the resource.

Answer: C — Updating a tag on the resource.

ReadOnly locks block any update or delete, INCLUDING tag changes. RBAC role assignments are stored at scope (not as resource property) and are generally allowed. Reading is always allowed. Common trap: locks don't block role assignments.

What does Azure Policy do in an Azure environment?

1. It assigns permissions to users and groups over a scope that you select
2. It audits and enforces rules such as allowed regions or required tags
3. It stores deployment templates for reuse across several subscriptions
4. It blocks deletion of a resource until the protecting setting is removed
5. It reports idle resources and recommends cheaper sizes for each of them

Answer: B — It audits and enforces rules such as allowed regions or required tags

B is the governance role: a policy definition tests a property of a resource and an effect such as audit, deny, modify or deployIfNotExists decides what happens, with initiatives bundling related definitions under one assignment. A describes role-based access control, which answers who may act rather than what may be created. C describes template specs. D describes a resource lock, a narrower protection. E describes Azure Advisor recommendations.

How long is the AZ-104 certification valid, and how is it renewed?

Valid for 1 year. It is renewed free of charge by passing an unproctored online assessment on Microsoft Learn, which becomes available in the 6 months before the expiration date and can be retaken if failed.

What is the difference between a security group and a Microsoft 365 group, and which can hold devices?

A security group grants access to resources and can be assigned Azure roles or licenses; it can contain users, devices, service principals and other groups. A Microsoft 365 group provides shared collaboration resources such as a mailbox and site, contains users only, and cannot contain devices.

Azure Policy?

Enforce rules on resources. Audit or restrict. Examples: 'must have tag', 'allowed regions only'.

Reserved Instances?

1- or 3-year commitment for VMs. Up to 72% discount.