Free AZ-104 practice test 2026: 20 questions without signup

Questions on the exam

about 50 — vendor indicates, no fixed count published

Time allowed

100 minutes format →

Passing score

700 of 1000 — vendor, checked September 4, 2026 detail →

Exam fee

$165 — vendor, checked September 5, 2026 detail →

834 practice test questions for Microsoft Azure Administrator AZ-104, grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min AZ-104 readiness check →

AZ-104 certification: requirements, cost and exam format → ·  AZ-104 exam format →  ·  AZ-104 passing score →  · AZ-104 exam cost →

Questions by domain

• Manage Azure identities and governance — 213 questions →
• Deploy and manage Azure compute resources — 196 questions →
• Implement and manage storage — 164 questions →
• Implement and manage virtual networking — 149 questions →
• Monitor and maintain Azure resources — 112 questions →

Sample questions

Guest user: Which user type is created when the contractor accepts the invitation?

1. Guest user ✓

   External users invited via Azure B2B collaboration are created as Guest users in the Entra ID tenant. Guest users can access resources shared with them but have limited directory access compared to member users.
2. Managed identity

   Managed identities are automatically managed identities for Azure resources (like VMs) to authenticate with Azure services. They are not used for external human users.
3. Member user

   Member users are internal users created directly in the Entra ID tenant. External B2B invited users are always created as Guest users, not Member users.
4. Service principal

   A service principal is an identity for applications and services to authenticate with Azure resources. It is not used for human external contractors invited via B2B collaboration.

All 213 Manage Azure identities and governance questions →

Incremental deployment mode: Which deployment mode should the administrator use?

1. Assign an Azure Policy in audit mode before deploying

   Audit policy reports compliance state; it does not select the ARM deployment behavior or preserve omitted resources.
2. Apply a CanNotDelete resource lock to the resource group before deploying

   A CanNotDelete lock blocks control-plane deletion but does not provide the required deployment mode and is not the mechanism for retaining omitted resources.
3. Complete deployment mode

   Complete mode can delete resources omitted from the template, so it risks removing the manually managed resources.
4. Incremental deployment mode ✓

   Incremental mode leaves resources omitted from the template in place while deploying the resources declared in the template.

All 196 Deploy and manage Azure compute resources questions →

Issue a minimally scoped service SAS referencing a stored: Which action should the administrator take?

1. Create a private endpoint for the storage account and use it instead of a SAS to authorize the external application.

   A private endpoint provides private network connectivity, not delegated storage authorization. It does not replace a SAS for granting the external application scoped, time-limited access.
2. Create a user delegation SAS for the container and manage revocation by changing the container's stored access policy.

   A user delegation SAS uses Entra credentials and applies to blobs, but it cannot reference a stored access policy. Therefore, changing that policy does not provide the stated centralized revocation mechanism.
3. Create an account SAS and associate it with a stored access policy on the container.

   An account SAS cannot reference a stored access policy, so this configuration cannot provide the required policy-based centralized revocation.
4. Issue a minimally scoped service SAS referencing a stored access policy. ✓

   A service SAS can reference a container stored access policy. Changing that policy can revoke associated service SAS tokens without rotating account keys, while permissions and expiry limit access.

All 164 Implement and manage storage questions →

Create a direct peering between AppVNet and DataVNet: Which action meets this requirement?

1. Create a direct peering between AppVNet and DataVNet. ✓

   Direct peering connects the two required VNets over the Microsoft backbone, and their nonoverlapping address spaces satisfy the stated prerequisite.
2. Create a private DNS zone link from DataVNet to AppVNet.

   A private DNS VNet link supports name resolution for a zone; it does not connect the VNets or provide network communication between their VMs.
3. Rely on the existing AppVNet-to-HubVNet and HubVNet-to-DataVNet peerings.

   VNet peering is not transitive. The two existing peerings do not create connectivity between AppVNet and DataVNet.
4. Link the existing private DNS zone to both AppVNet and DataVNet.

   Linking a private DNS zone to both VNets can enable DNS resolution in each VNet, but peering is still required for the requested VM-to-VM network connectivity.

All 149 Implement and manage virtual networking questions →

Schedule action-group suppression for the resource: Which action should the administrator take?

1. Schedule action-group suppression for the resource with an alert processing rule. ✓

   An alert processing rule can suppress action groups for fired alerts during a scheduled window while leaving alert evaluation enabled.
2. Remove the notification actions from the alert’s action group for the maintenance window, then restore them afterward.

   Action groups define notification and other actions, but changing one affects its configuration rather than providing a scheduled suppression of fired-alert actions.
3. Disable the metric alert rule at the start of maintenance and re-enable it afterward.

   Disabling the rule stops it from firing during the window, so it does not preserve continuous alert evaluation.
4. Add a diagnostic setting that sends the resource metrics to a Log Analytics workspace during maintenance.

   Diagnostic settings route selected metrics and logs to destinations; they do not suppress alert action groups or control notifications.

All 112 Monitor and maintain Azure resources questions →

Microsoft Entra ID P1 or P2: Which Microsoft Entra ID license tier is required to enable SSPR for all users?

1. Microsoft Entra ID Free

   Microsoft Entra ID Free provides SSPR only for cloud administrator accounts (not all users). SSPR for all users requires at minimum P1 licensing or a Microsoft 365 subscription with SSPR included.
2. Microsoft Entra ID P1 or P2 ✓

   Microsoft Entra ID P1 or P2 licenses are required to enable SSPR for all users. SSPR for cloud-only accounts with the Microsoft Entra ID Free tier requires Microsoft 365 license and has limitations — full SSPR for all scenarios requires at least P1.
3. Microsoft Entra ID P2 only

   SSPR is available with both P1 and P2 licenses, not P2 exclusively. P2 adds additional features like Identity Protection and Privileged Identity Management, but SSPR is included in P1.
4. No additional license is required beyond Microsoft Entra ID

   While some SSPR functionality exists at lower tiers, enabling SSPR for all non-admin users requires a P1 or P2 license. The Free tier restricts SSPR to global admins only.

All 213 Manage Azure identities and governance questions →

Update the Bicep template so the virtual machine satisfies: What should you do?

1. Change the deployment to complete mode so the resource is created despite the policy assignment.

   Deployment mode does not bypass policy evaluation. Complete mode can also delete resources omitted from the template, so it is not a solution to this denial.
2. Update the Bicep template so the virtual machine satisfies the policy requirements, then redeploy it. ✓

   Policy evaluates resource properties and a deny effect blocks a noncompliant new or updated resource operation. Correcting the template addresses the effective policy decision.
3. Grant the administrator an additional Azure RBAC role at the resource-group scope and redeploy the unchanged template.

   RBAC authorizes user actions, but it does not make resource properties compliant with Azure Policy. The inherited deny still applies.
4. Assign an audit policy at the resource-group scope and redeploy the unchanged template.

   An audit assignment reports noncompliance but does not replace or neutralize the inherited deny assignment. The unchanged operation remains blocked.

All 196 Deploy and manage Azure compute resources questions →

Make the account’s DNS name resolve to its private: What should you do first?

1. Make the account’s DNS name resolve to its private endpoint in the application VNet. ✓

   The private endpoint exists, but the client is resolving the service name incorrectly. Correct DNS resolution directs traffic to the private endpoint.
2. Assign Reader on the storage account to the VM's managed identity so it can use the private endpoint.

   Azure RBAC permissions and private connectivity are separate. Reader also does not correct the client's DNS resolution.
3. Grant the VM's managed identity Storage Blob Data Reader at the storage-account scope.

   This can address authorization for blob reads, but it does not change name resolution or establish the private network path.
4. Disable public network access on the storage account and leave DNS unchanged.

   Restricting public access does not make the existing public DNS result resolve to the private endpoint; the DNS problem remains.

All 164 Implement and manage storage questions →

AZ-104 exam: the facts

How many questions are on the AZ-104 exam?

Around 50. The vendor does not publish a fixed count for AZ-104, so this is the figure it indicates rather than a guaranteed number.

How long is the AZ-104 exam?

100 minutes. Across 50 questions that is about 120 seconds per question.

What topics does the AZ-104 exam cover?

5 domains: Manage Azure identities and governance, Deploy and manage Azure compute resources, Implement and manage storage, Implement and manage virtual networking, Monitor and maintain Azure resources. Weights: Manage Azure identities and governance 22.5%, Deploy and manage Azure compute resources 22.5%, Implement and manage storage 17.5%, Implement and manage virtual networking 17.5%, Monitor and maintain Azure resources 12.5%.

How many AZ-104 practice test questions does Certsqill have?

834, spread across 5 exam domains. Every one shows all options, which is correct, and why each of the others is not.

What AZ-104 exam questions test

AZ-104 exam questions are written against Microsoft’s published skills outline, currently the version with skills measured as of April 17, 2026. Each one belongs to one of five areas: identities and governance (20–25%), storage (15–20%), compute (20–25%), virtual networking (15–20%), and monitoring and maintenance (10–15%).

The verbs in the outline set the tone. Where AZ-900 asks you to describe Azure, AZ-104 asks you to configure, manage, deploy, interpret and troubleshoot it — assign roles at different scopes, modify a Bicep file, configure private endpoints, perform a failover with Site Recovery. Good AZ-104 questions therefore put you in a scenario and ask which setting, scope or service solves it, often with several options that would work in a slightly different situation.

That is also the test for any AZ-104 practice questions you find elsewhere. If a question relies on a product name Microsoft has since replaced, or tests something the current outline no longer lists, it was written for an older version of the exam.

AZ-104 exam questions count and format

Microsoft does not publish a fixed AZ-104 exam questions count. Its general guidance is that most Microsoft Certification exams contain between 40 and 60 questions, but that the number varies by exam and changes as exams are updated. Some questions may be unscored, and you will not know which ones.

For associate role-based exams without labs, Microsoft gives 100 minutes of exam time and 120 minutes of seat time; exams that may contain labs get 120 minutes. Microsoft does not identify question types in advance, but its sample videos cover formats such as multiple choice, drag and drop, hot area, build list, case studies and labs. In a case study you can take a break, but you cannot return to questions you saw before it.

The free Microsoft Learn AZ-104 practice test

Microsoft runs a free practice assessment for AZ-104 on Microsoft Learn, and states that practice assessments “can be attempted as many times as desired”. If you want an AZ-104 practice test free of charge from the exam owner, this is the one to take first.

Microsoft is explicit about its limits: the questions “are not the same as what you will see on the exam”, and the assessment is not illustrative of the exam’s length or complexity. Treat the Microsoft AZ-104 practice exam as a guide to wording and difficulty, then use the exam sandbox once to get used to the interface.

AZ-104 dumps: what they are and why they are a risk

AZ-104 dumps are collections of questions claimed to come from the live exam. Microsoft’s certification program agreement classes exam questions and answers as confidential information and forbids candidates to “distribute, copy, display, publish, summarize, photograph, record, download, transmit or post” them. If Microsoft believes the agreement was breached, it may invalidate exam results, bar you from future exams and decertify you, without refunding exam fees.

There is also a practical problem. You cannot tell whether the answers in an AZ-104 exam dump are correct, or whether its questions still match the current outline. A file labelled “AZ-104 dumps 2023” predates the April 2026 skills outline, and a newer label — “AZ-104 dumps 2026”, say, or “AZ-104 exam dumps 2026” — tells you nothing about whether the content inside was updated or merely renamed. Studying the reasoning behind each answer is what still works when Microsoft changes its question pool.

How Certsqill’s AZ-104 practice exams work

The AZ-104 practice exams here are expert-developed against Microsoft’s five skill areas. Every question comes with an explanation for each answer option, so AZ-104 exam questions and answers here work as study material rather than an answer key: you see why the right option fits the scenario and why each of the others would fail at that scope, in that region or with that configuration.

Your results feed a readiness score per domain, which shows whether networking or storage still costs you points instead of hiding it in one overall percentage. Because Microsoft scores the exam on a scaled range from 1 to 1,000, with 700 to pass, no practice percentage converts directly into an exam score; the domain view is the useful signal. Access comes with a 7-day money-back guarantee.

Use these AZ-104 questions alongside the free Microsoft assessment rather than instead of it, and after you have worked through a course or Microsoft’s learning paths: practice is most valuable once you have studied each area at least once.

If you do not pass first time

Microsoft’s retake policy for role-based exams requires a 24-hour wait after a first failed attempt and 14 days between later attempts, with no more than five attempts in 12 months from your first try. Each retake has to be paid for. The score report’s bar chart per skill area is the best guide to what to study before you try again.

After you pass: renew every 12 months

Passing is not the end of it: AZ-104 must be renewed every 12 months. Renewal is a free online assessment on Microsoft Learn, which Microsoft describes as shorter than the original exam, unproctored and open book, focused on recent technology updates. Keeping your practice up between renewals makes that assessment routine.

AZ-104 practice: questions people ask

How many questions are on the AZ-104 exam?

Microsoft publishes no fixed number for AZ-104. Its general guidance is that most certification exams contain 40 to 60 questions, varying by exam. Checked 9 October 2026.

Is there a free AZ-104 practice test?

Yes. Microsoft offers a free practice assessment on Microsoft Learn that you can take as often as you like. Microsoft notes that its questions are not the same as those on the exam.

Are AZ-104 exam dumps allowed?

No. Microsoft’s program agreement treats exam questions and answers as confidential and forbids sharing them. Microsoft may invalidate results, bar candidates from exams and decertify them for breaches.

How do I renew AZ-104 after passing?

By passing a free online renewal assessment on Microsoft Learn during the six-month window before your certification expires. Once you pass, Microsoft extends the certification one year from the expiration date.

AZ-104 in detail

• AZ-104 exam: objectives, format and scheduling →
• AZ-104 study guide: what to study and in what order →
• AZ-104 training and courses: what Microsoft offers and how to choose →