AZ-104: 722 practice test questions with explanations
7-day money-back guarantee — full refund within 7 days of purchase if you've completed under 20% of the questions. See pricing →
Certifications Tools Flashcards Career Paths Exam Guides Blog Pricing For Teams About

Language

✓ EnglishDeutschEspañolFrançaisPortuguês
Check readiness — free →

AZ-104 practice test: 722 questions with full explanations

5 domains 722 questions 100 min exam
Questions on the exam
about 50 — vendor indicates, no fixed count published
Time allowed
100 minutes format →
Passing score
700 of 1000 — vendor, checked September 4, 2026 detail →
Exam fee
$165 — vendor, checked September 5, 2026 detail →

722 practice test questions for Microsoft Azure Administrator AZ-104, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min AZ-104 readiness check →

AZ-104 exam format →  ·  AZ-104 passing score →  · AZ-104 exam cost →

Questions by domain

Sample questions

Guest user: Which user type is created when the contractor accepts the invitation?

Manage Azure identities and governance Easy
A company's Microsoft Entra ID tenant has both internal employees and external contractors. An administrator needs to invite a contractor from a partner company to access a shared Teams channel. Which user type is created when the contractor accepts the invitation?
  1. Guest user ✓
    External users invited via Azure B2B collaboration are created as Guest users in the Entra ID tenant. Guest users can access resources shared with them but have limited directory access compared to member users.
  2. Managed identity
    Managed identities are automatically managed identities for Azure resources (like VMs) to authenticate with Azure services. They are not used for external human users.
  3. Member user
    Member users are internal users created directly in the Entra ID tenant. External B2B invited users are always created as Guest users, not Member users.
  4. Service principal
    A service principal is an identity for applications and services to authenticate with Azure resources. It is not used for human external contractors invited via B2B collaboration.
The trap
Thinking external invited users become Member users — B2B collaboration always creates Guest users with limited tenant access.

All 186 Manage Azure identities and governance questions →

Incremental deployment mode: Which deployment mode should the administrator use?

Deploy and manage Azure compute resources Easy
You have an Azure subscription. You must deploy a Bicep template to an existing resource group to add a virtual machine. The resource group also contains several manually managed resources that are intentionally absent from the template and must remain unchanged. Which deployment mode should the administrator use?
  1. Assign an Azure Policy in audit mode before deploying
    Audit policy reports compliance state; it does not select the ARM deployment behavior or preserve omitted resources.
  2. Apply a CanNotDelete resource lock to the resource group before deploying
    A CanNotDelete lock blocks control-plane deletion but does not provide the required deployment mode and is not the mechanism for retaining omitted resources.
  3. Complete deployment mode
    Complete mode can delete resources omitted from the template, so it risks removing the manually managed resources.
  4. Incremental deployment mode ✓
    Incremental mode leaves resources omitted from the template in place while deploying the resources declared in the template.
The trap
Do not confuse a deletion lock or Azure Policy with deployment behavior; identify whether omitted resources must remain in scope.

All 169 Deploy and manage Azure compute resources questions →

Issue a minimally scoped service SAS referencing a stored: Which action should the administrator take?

Implement and manage storage Easy
Your company must let an external application upload blobs to one container for a limited period. The administrator must use least privilege and be able to revoke all issued access centrally without rotating the storage account keys. Which action should the administrator take?
  1. Create a private endpoint for the storage account and use it instead of a SAS to authorize the external application.
    A private endpoint provides private network connectivity, not delegated storage authorization. It does not replace a SAS for granting the external application scoped, time-limited access.
  2. Create a user delegation SAS for the container and manage revocation by changing the container's stored access policy.
    A user delegation SAS uses Entra credentials and applies to blobs, but it cannot reference a stored access policy. Therefore, changing that policy does not provide the stated centralized revocation mechanism.
  3. Create an account SAS and associate it with a stored access policy on the container.
    An account SAS cannot reference a stored access policy, so this configuration cannot provide the required policy-based centralized revocation.
  4. Issue a minimally scoped service SAS referencing a stored access policy. ✓
    A service SAS can reference a container stored access policy. Changing that policy can revoke associated service SAS tokens without rotating account keys, while permissions and expiry limit access.
The trap
Distinguish service SAS plus stored access policy from user delegation SAS: only the service SAS can use that policy-based revocation mechanism.

All 141 Implement and manage storage questions →

Create a direct peering between AppVNet and DataVNet: Which action meets this requirement?

Implement and manage virtual networking Medium
An Azure administrator manages HubVNet, AppVNet, and DataVNet. The address spaces of all three VNets do not overlap. AppVNet is already peered with HubVNet, and DataVNet is already peered with HubVNet. App VMs must communicate directly with Data VMs over the Azure backbone. Which action meets this requirement?
  1. Create a direct peering between AppVNet and DataVNet. ✓
    Direct peering connects the two required VNets over the Microsoft backbone, and their nonoverlapping address spaces satisfy the stated prerequisite.
  2. Create a private DNS zone link from DataVNet to AppVNet.
    A private DNS VNet link supports name resolution for a zone; it does not connect the VNets or provide network communication between their VMs.
  3. Rely on the existing AppVNet-to-HubVNet and HubVNet-to-DataVNet peerings.
    VNet peering is not transitive. The two existing peerings do not create connectivity between AppVNet and DataVNet.
  4. Link the existing private DNS zone to both AppVNet and DataVNet.
    Linking a private DNS zone to both VNets can enable DNS resolution in each VNet, but peering is still required for the requested VM-to-VM network connectivity.
The trap
Do not confuse hub-and-spoke peering with transitive routing: peer each pair that requires direct connectivity unless another explicitly configured connectivity mechanism is provided.

All 130 Implement and manage virtual networking questions →

Schedule action-group suppression for the resource: Which action should the administrator take?

Monitor and maintain Azure resources Hard
During a planned maintenance window, an administrator must prevent notification actions from a metric alert on an Azure resource. After maintenance, the alert must continue evaluating normally, and the alert rule must remain enabled. Suppression and resumption must occur on a schedule without editing the shared action group. Which action should the administrator take?
  1. Schedule action-group suppression for the resource with an alert processing rule. ✓
    An alert processing rule can suppress action groups for fired alerts during a scheduled window while leaving alert evaluation enabled.
  2. Remove the notification actions from the alert’s action group for the maintenance window, then restore them afterward.
    Action groups define notification and other actions, but changing one affects its configuration rather than providing a scheduled suppression of fired-alert actions.
  3. Disable the metric alert rule at the start of maintenance and re-enable it afterward.
    Disabling the rule stops it from firing during the window, so it does not preserve continuous alert evaluation.
  4. Add a diagnostic setting that sends the resource metrics to a Log Analytics workspace during maintenance.
    Diagnostic settings route selected metrics and logs to destinations; they do not suppress alert action groups or control notifications.
The trap
Distinguish suppressing alert actions with an alert processing rule from disabling the alert rule itself.

All 96 Monitor and maintain Azure resources questions →

Microsoft Entra ID P1 or P2: Which Microsoft Entra ID license tier is required to enable SSPR for all users?

Manage Azure identities and governance Medium
A company wants to allow users to reset their own passwords without calling the help desk. Microsoft Entra SSPR is being configured. Which Microsoft Entra ID license tier is required to enable SSPR for all users?
  1. Microsoft Entra ID Free
    Microsoft Entra ID Free provides SSPR only for cloud administrator accounts (not all users). SSPR for all users requires at minimum P1 licensing or a Microsoft 365 subscription with SSPR included.
  2. Microsoft Entra ID P1 or P2 ✓
    Microsoft Entra ID P1 or P2 licenses are required to enable SSPR for all users. SSPR for cloud-only accounts with the Microsoft Entra ID Free tier requires Microsoft 365 license and has limitations — full SSPR for all scenarios requires at least P1.
  3. Microsoft Entra ID P2 only
    SSPR is available with both P1 and P2 licenses, not P2 exclusively. P2 adds additional features like Identity Protection and Privileged Identity Management, but SSPR is included in P1.
  4. No additional license is required beyond Microsoft Entra ID
    While some SSPR functionality exists at lower tiers, enabling SSPR for all non-admin users requires a P1 or P2 license. The Free tier restricts SSPR to global admins only.
The trap
Thinking SSPR is free for all users — Entra ID Free tier limits SSPR to admin accounts. P1 or P2 is required for all-user SSPR.

All 186 Manage Azure identities and governance questions →

Update the Bicep template so the virtual machine satisfies: What should you do?

Deploy and manage Azure compute resources Medium
You have an Azure subscription. You deploy a virtual machine from a Bicep template to a resource group. The deployment is denied because an Azure Policy assignment inherited from the management group disallows the submitted resource properties. The administrator has deployment permissions and must complete the deployment without weakening governance. What should you do?
  1. Change the deployment to complete mode so the resource is created despite the policy assignment.
    Deployment mode does not bypass policy evaluation. Complete mode can also delete resources omitted from the template, so it is not a solution to this denial.
  2. Update the Bicep template so the virtual machine satisfies the policy requirements, then redeploy it. ✓
    Policy evaluates resource properties and a deny effect blocks a noncompliant new or updated resource operation. Correcting the template addresses the effective policy decision.
  3. Grant the administrator an additional Azure RBAC role at the resource-group scope and redeploy the unchanged template.
    RBAC authorizes user actions, but it does not make resource properties compliant with Azure Policy. The inherited deny still applies.
  4. Assign an audit policy at the resource-group scope and redeploy the unchanged template.
    An audit assignment reports noncompliance but does not replace or neutralize the inherited deny assignment. The unchanged operation remains blocked.
The trap
When a deployment is denied for resource properties, fix the template or effective policy scope; extra RBAC permissions do not bypass Azure Policy.

All 169 Deploy and manage Azure compute resources questions →

Make the account’s DNS name resolve to its private: What should you do first?

Implement and manage storage Medium
You have an Azure subscription that contains a storage account with a private endpoint in the application VNet. From a VM in that VNet, the storage account name still resolves to its public address, so the application cannot use the intended private path after public network access is restricted. Authentication is already configured, and no deny assignments exist. What should you do first?
  1. Make the account’s DNS name resolve to its private endpoint in the application VNet. ✓
    The private endpoint exists, but the client is resolving the service name incorrectly. Correct DNS resolution directs traffic to the private endpoint.
  2. Assign Reader on the storage account to the VM's managed identity so it can use the private endpoint.
    Azure RBAC permissions and private connectivity are separate. Reader also does not correct the client's DNS resolution.
  3. Grant the VM's managed identity Storage Blob Data Reader at the storage-account scope.
    This can address authorization for blob reads, but it does not change name resolution or establish the private network path.
  4. Disable public network access on the storage account and leave DNS unchanged.
    Restricting public access does not make the existing public DNS result resolve to the private endpoint; the DNS problem remains.
The trap
A private endpoint and usable private access are not identical: always verify DNS resolution separately from authentication and public network access settings.

All 141 Implement and manage storage questions →

AZ-104 exam: the facts

How many questions are on the AZ-104 exam?

Around 50. The vendor does not publish a fixed count for AZ-104, so this is the figure it indicates rather than a guaranteed number.

How long is the AZ-104 exam?

100 minutes. Across 50 questions that is about 120 seconds per question.

What topics does the AZ-104 exam cover?

5 domains: Manage Azure identities and governance, Deploy and manage Azure compute resources, Implement and manage storage, Implement and manage virtual networking, Monitor and maintain Azure resources. Weights: Manage Azure identities and governance 0.225%, Deploy and manage Azure compute resources 0.225%, Implement and manage storage 0.175%, Implement and manage virtual networking 0.175%, Monitor and maintain Azure resources 0.125%.

How many AZ-104 practice test questions does Certsqill have?

722, spread across 5 exam domains. Every one shows all options, which is correct, and why each of the others is not.

Would you pass AZ-104 today?

Five minutes, and you get a score per domain — not one number, but which section to open tonight.

Test your AZ-104 readiness — free
Certsqill AZ-104 question bank · 722 questions across 5 domains · Every answer, right and wrong, comes with its own explanation.