Azure Administrator (AZ-104) Practice Questions¶

40 scenario-based questions weighted by exam domain.

Exam Domain Breakdown¶

Cert page: exams/azure/az-104/

Domain 1: Manage Azure Identities and Governance (Questions 1-9)¶

Question 1¶

Scenario: A company needs to ensure that users can only create virtual machines in the West US and East US regions. This policy must apply to all subscriptions under a management group. What should you configure?

A. Azure Policy with the Allowed locations built-in definition, assigned at the management group scope so that every subscription inherits it B. Azure RBAC role assignment at the management group level that gives the VM Contributor role only to the users in the two regions C. Resource locks on all resource groups in every subscription, with a CanNotDelete lock on groups outside the two regions D. Subscription-level budget alerts that email the owners whenever spending rises in a region outside the approved list

Question 2¶

Scenario: A company has Microsoft 365 users who need access to Azure resources. They want to use existing identities without creating separate Azure AD accounts. The company already has Azure AD Connect synchronizing on-premises AD. What additional configuration is needed?

A. Configure Azure AD B2B collaboration, inviting each Microsoft 365 user as a guest so that the identity exists in the Azure tenant B. Azure AD B2C with a customer tenant for the users C. No additional configuration - Azure AD Connect already handles this D. Install a second Azure AD Connect server in staging mode so that Azure resources can use the synchronized identities

Question 3¶

Scenario: A security administrator needs to require MFA for all users accessing the Azure portal, but not for other applications. How should this be configured?

A. Enable Security Defaults, which require MFA registration and prompt administrators and users on every cloud app in the tenant B. Configure per-user MFA settings, setting each user to Enforced so they must complete MFA when they sign in to the portal C. Use Azure AD Identity Protection with a sign-in risk policy that asks for MFA whenever a sign-in to the portal looks risky D. Create a Conditional Access policy targeting the Azure portal cloud app requiring MFA

Question 4¶

Scenario: A company needs to delegate the ability to create and manage virtual machines to a team without giving them access to modify networking or storage resources. Which built-in RBAC role should be assigned?

A. Owner B. Contributor C. Virtual Machine Administrator Login D. Virtual Machine Contributor

Question 5¶

Scenario: An organization wants to prevent accidental deletion of a production resource group containing critical databases. Users should still be able to modify resources within the group. What should you implement?

A. Read-only lock on the resource group B. Delete lock on the resource group, which blocks deletion but still allows edits C. Azure Policy with the Audit effect on delete operations D. Remove Contributor role from users

Question 6¶

Scenario: A company needs to track all changes made to Azure resources for compliance auditing. They need to know who made what change and when. What should they configure?

A. Resource health alerts B. Azure Activity Log with export to Log Analytics C. Azure Advisor recommendations, which list reliability, security, and cost improvements for the deployed resources D. Azure Monitor Metrics, which store numeric performance data for each resource and can be charted over time

Question 7¶

Scenario: A company with multiple subscriptions wants to organize them into a hierarchy for policy and access management. Development subscriptions should inherit different policies than production. What should they create?

A. Multiple Azure AD tenants, one for development and one for production, with each subscription linked to its own tenant B. Management groups with production and development groups C. Resource groups in each subscription, named for development and production, with policies assigned to each group D. Azure Blueprints assigned to each subscription, with a different blueprint definition for development and production

Question 8¶

Scenario: A company needs to provision consistent environments for new projects, including virtual networks and VMs. They want to store the template in Azure as a versioned resource, control who can deploy it with Azure RBAC, and deploy it to many subscriptions. What should they use?

A. A Bicep file kept on an administrator's laptop and emailed to teams whenever they ask for it B. Template specs, which store a versioned ARM template as an Azure resource that is shared and deployed with RBAC C. Azure Resource Graph queries that read the resources in each subscription D. Azure Policy initiatives, which group policy definitions for assignment

Question 9¶

Scenario: An administrator needs to grant a consultant temporary elevated access to troubleshoot production issues. The access should automatically expire after 8 hours and require approval.

A. Add the consultant to a privileged group permanently and remove the membership by hand after the troubleshooting is over B. Use Azure AD Privileged Identity Management (PIM) with time-bound eligible assignment C. Share the administrator credentials with the consultant and change the password after the troubleshooting is over D. Create a temporary user account with the Owner role that is deleted later, once the troubleshooting is complete

Domain 2: Implement and Manage Storage (Questions 10-16)¶

Question 10¶

Scenario: A company needs to store files that will be accessed by multiple Azure VMs across different regions. The files are accessed frequently and must support SMB protocol. What storage solution should they use?

A. Azure Blob Storage with the hot tier, mounted on each VM through the NFS 3.0 endpoint of the storage account B. Azure Queue Storage, with a queue per VM that holds the file contents for the other machines to read C. Azure Files with an SMB share on the Premium tier D. Azure Disk Storage with shared disks, attached to each of the VMs across the regions through a cluster

Question 11¶

Scenario: An application stores images in Azure Blob Storage. Images are frequently accessed for the first 30 days, rarely accessed for the next 90 days, and then must be retained for 7 years for compliance. How should you configure storage to minimize cost?

A. Configure lifecycle management rules: hot → cool after 30 days → archive after 120 days B. Use the hot tier for all blobs and archive them by hand after 120 days C. Use premium block blob storage for all blobs, which offers the lowest latency for the images in the first 30 days D. Store all blobs in the archive tier from the start, for the lowest price

Question 12¶

Scenario: A company needs to migrate 50TB of file share data from an on-premises Windows Server to Azure Files. They want to minimize downtime and maintain SMB compatibility. What migration approach should they use?

A. Azure File Sync to synchronize and migrate B. AzCopy to copy files directly to Azure Files in one pass C. Azure Data Box for offline transfer D. Azure Migrate for server migration

Question 13¶

Scenario: A storage account contains sensitive data. The security team requires that data is encrypted with a key managed in Azure Key Vault, and the key must be rotated annually. What should you configure?

A. Microsoft-managed keys (default encryption), which Microsoft rotates on its own schedule with no key in your Key Vault B. Client-side encryption, where the app encrypts each blob before upload C. Customer-managed keys (CMK) in Key Vault, with an automatic annual key rotation policy D. Infrastructure encryption, which adds a second layer of platform encryption

Question 14¶

Scenario: A company needs to provide time-limited access to a specific blob for a partner organization. The partner should only be able to download the file for the next 24 hours without requiring Azure AD credentials.

A. Make the blob container public for 24 hours, then set it back to private B. Allow anonymous read access on the storage account, then disable it later C. Create an Azure AD guest user for the partner, assign the Storage Blob Data Reader role, and delete the guest later D. Generate a shared access signature (SAS) with 24-hour expiry and read permissions

Question 15¶

Scenario: A storage account is configured with network rules to allow access only from a specific virtual network. An Azure Function in a different virtual network needs to access the storage account. What should you configure?

A. Add the Function's private IP address range to the storage account firewall as an allowed IP rule B. Disable the firewall on the storage account so the Function can reach it from any network, then enable it again later C. Use managed identity authentication for the Function, with a role assignment on the storage account D. Configure a private endpoint for the storage account and VNet peering between the networks

Question 16¶

Scenario: A company must ensure that deleted blobs can be recovered for 30 days. They also need to recover from accidental overwrites. What should they enable?

A. Soft delete for containers only, with 30-day retention B. A CanNotDelete lock on the storage account, which blocks anyone from deleting or overwriting blobs C. Geo-redundant storage, which keeps a copy of every blob in the paired region for recovery D. Soft delete, blob versioning, and point-in-time restore together

Domain 3: Deploy and Manage Azure Compute Resources (Questions 17-25)¶

Question 17¶

Scenario: A company needs to deploy a web application that must survive a data center failure within a region. The application uses IaaS virtual machines. What should you configure?

A. Deploy VMs across multiple availability zones with a load balancer B. Copy the VMs into multiple resource groups in the region C. Use a Virtual Machine Scale Set with a single instance D. Deploy VMs in a single availability zone, with a Standard load balancer and managed disks that use ZRS

Question 18¶

Scenario: A web application experiences variable traffic with peaks on weekends. You want to automatically scale the number of VM instances between 2 and 10 based on CPU utilization. What should you deploy?

A. Virtual Machine Scale Set with autoscale rules B. Azure Batch C. Virtual machines with Azure Automation runbooks that add or remove machines by hand D. Load balancer with health probes that take unhealthy VMs out of rotation

Question 19¶

Scenario: A development team needs to run containers without managing infrastructure. The containers run batch jobs that complete in a few minutes and don't need to be always running. What service should they use?

A. Azure App Service, with a WebJob that runs each batch task and scales out when the job queue grows B. Azure Container Instances (ACI) C. Virtual Machines with Docker installed, started by a schedule before each job and shut down when it ends D. Azure Kubernetes Service (AKS), with a Kubernetes Job for each batch run on a node pool that scales to zero

Question 20¶

Scenario: A company is migrating Windows Server VMs from on-premises to Azure. They want to bring their existing Windows Server licenses with Software Assurance to reduce costs. How should they configure the VMs?

A. Use Dev/Test subscription B. Enable Azure Hybrid Benefit on the VMs C. Select Windows Server license during VM creation D. Request a discount from Microsoft

Question 21¶

Scenario: A VM is running low on disk space. The OS disk is 128GB and needs to be increased to 256GB. What steps are required?

A. Add a data disk instead, then move the application files to it and leave the 128GB OS disk as it is today B. Create a new 256GB disk, copy the data to it, and swap it in as the OS disk C. Stop (deallocate) the VM, resize the OS disk, start the VM, then extend the partition in the OS D. Resize the disk while the VM is running, and the OS then uses the new space automatically with no extra steps

Question 22¶

Scenario: A company wants to deploy a web application that automatically scales, supports deployment slots for zero-downtime deployments, and doesn't require managing VMs. The application is a .NET Core app. What should they use?

A. Azure Container Instances B. Virtual Machine Scale Set C. Azure Batch D. Azure App Service

Question 23¶

Scenario: A Windows VM in Azure cannot be accessed via RDP. The VM shows as running in the portal. What should you check first?

A. Boot diagnostics and Network Security Group rules B. Check the Azure status page for outages in the region, and wait for the incident to be resolved before any change C. Increase the VM size to give the machine more CPU and memory, in case the RDP service is starved of resources D. Recreate the VM from the last backup

Question 24¶

Scenario: A company needs to run GPU-accelerated machine learning training jobs on Azure. Jobs run for several hours and cost optimization is important. What VM configuration should they use?

A. NC-series VMs with Spot pricing B. Fsv2-series VMs C. Standard D-series VMs D. B-series burstable VMs

Question 25¶

Scenario: A company wants to ensure their VMs are backed up with daily backups retained for 30 days and weekly backups retained for 1 year. What should they configure?

A. Azure Site Recovery, which replicates the VMs to a second region and holds recovery points for 30 days B. Manual snapshots taken by Azure Automation runbooks each day and deleted after 30 days C. Azure Backup, using a Recovery Services vault policy that keeps daily points for 30 days and weekly points for 1 year D. Storage account replication to a second region, which keeps a copy of the VM disks that can be restored

Domain 4: Implement and Manage Virtual Networking (Questions 26-32)¶

Question 26¶

Scenario: A company has two virtual networks in the same region that need to communicate. They want low latency and private IP connectivity. What should they configure?

A. Application Gateway B. ExpressRoute C. VPN Gateway connections D. VNet peering between the two virtual networks

Question 27¶

Scenario: A web application needs to be accessible from the internet with high availability across zones. The application runs on VMs in a backend pool. HTTPS traffic should be terminated at the load balancer. What should you deploy?

A. Azure Load Balancer (Standard), a zone-redundant public load balancer that spreads HTTPS connections over the backend pool B. Azure Application Gateway with WAF C. Azure Firewall Standard with DNAT rules that publish the backend VMs to the internet on port 443 D. Azure Traffic Manager, which uses DNS to send clients to a healthy endpoint and so gives high availability

Question 28¶

Scenario: A company needs to restrict outbound internet access from VMs to only approved URLs. They want to allow access to *.microsoft.com but block all other internet traffic. What should they configure?

A. Azure Firewall with application rules B. User Defined Routes to null route internet C. Service endpoints D. Network Security Group with FQDN rules for *.microsoft.com

Question 29¶

Scenario: A company's Azure VMs need to access Azure Storage privately without traffic going over the internet. They want to keep the storage account firewall enabled while allowing VNet access. What should they configure?

A. Disable storage firewall B. VPN Gateway C. A NAT gateway on the subnet D. Service Endpoints for storage on the VNet subnet

Question 30¶

Scenario: A company has a subnet with VMs that should not be accessible from other subnets in the same VNet. Only specific management ports should be allowed from a management subnet. What should you configure?

A. A separate VNet for the VMs, peered with the management VNet, with all ports allowed across the peering B. Application Security Groups, which group the VMs for use in rules C. Azure Firewall deployed in the same subnet as the VMs D. Network Security Group on the subnet with deny rules and specific allow rules

Question 31¶

Scenario: A company wants to route all traffic from their VNet through a network virtual appliance (NVA) for inspection before going to the internet. What should they configure?

A. An Azure DNS private zone that resolves internet names to the NVA's address B. VNet peering with the NVA's VNet, so the traffic from the VMs is sent to the NVA before it reaches the internet C. Service Endpoints on each subnet, so that internet-bound traffic leaves through the Azure backbone and the NVA D. User Defined Routes (UDR) with next hop to the NVA

Question 32¶

Scenario: A company needs to connect their on-premises data center to Azure with dedicated, private connectivity (not over the internet). They need consistent low latency and high bandwidth. What should they implement?

A. Azure Virtual WAN with site-to-site VPN tunnels B. Point-to-Site VPN C. ExpressRoute with a connectivity provider D. Site-to-Site VPN with a VPN gateway and IPsec tunnel

Domain 5: Monitor and Maintain Azure Resources (Questions 33-40)¶

Question 33¶

Scenario: A company wants to receive email alerts when their VM CPU exceeds 80% for more than 5 minutes. What should they configure?

A. Azure Monitor alert rule with metric condition and email action group B. Log Analytics query C. Azure Advisor D. Azure Service Health

Question 34¶

Scenario: A company needs to analyze logs from multiple Azure resources including VMs, App Services, and Azure SQL. They want to write queries across all logs and create dashboards. What should they configure?

A. Use Azure Monitor Metrics, which store numeric time series for each resource and can be charted on a dashboard B. Use the Activity Log only, which records control plane operations for each of the subscriptions C. Send all logs to a Log Analytics workspace and use KQL queries D. Enable diagnostic settings without a destination, so that the logs are generated and held by each resource

Question 35¶

Scenario: A company needs to visualize the performance of their entire Azure environment in a single view including VM health, network topology, and application dependencies. What should they use?

A. Cost Management dashboard, which charts spending by tag B. The Azure Portal resource list, filtered by subscription C. Azure Monitor Workbooks with VM Insights and its dependency map view D. Resource Graph Explorer, which runs Kusto queries over resource properties across the subscriptions

Question 36¶

Scenario: A critical application runs on Azure. The team needs to be notified of Azure service issues that might affect their resources before they see impact. What should they configure?

A. Resource health checks B. Third-party monitoring C. Manual Azure status page monitoring D. Azure Service Health alerts for their subscriptions and regions

Question 37¶

Scenario: A VM in Azure needs regular maintenance including Windows Updates. The company wants to control when updates are applied to avoid impacting business hours. What should they configure?

A. Manual patching by an administrator, who signs in to each VM during a weekend window and runs the updates B. Azure Update Manager with maintenance windows C. Disable updates on the VMs and rebuild them from a new image once a quarter, with the patches already in it D. Windows Update automatic updates with default settings, with no maintenance window or schedule

Question 38¶

Scenario: A company has deployed resources but wants to ensure they follow Azure best practices for high availability, security, performance, and cost. What tool should they use?

A. Azure Blueprints B. Azure Advisor recommendations C. Microsoft Defender for Cloud with its secure score D. Azure Policy

Question 39¶

Scenario: A company needs to diagnose intermittent VM connectivity issues. They need to capture network traffic for analysis. What tool should they use?

A. Connection Monitor, which tests connectivity between endpoints over time and reports latency and reachability B. IP flow verify, which checks whether a packet to or from the VM is allowed or denied by the NSG rules C. Network Watcher packet capture D. NSG flow logs

Question 40¶

Scenario: A company wants to ensure they are alerted when their Azure spending is projected to exceed their monthly budget. What should they configure?

A. Azure Cost Management budget with forecast alerts B. Resource tags for cost tracking C. Pricing calculator D. Azure Advisor cost recommendations

Answer Key¶