Microsoft Azure Administrator (AZ-104) practice questions

Domain coverage 5 domains

• Manage Azure identities and governance
• Implement and manage storage
• Deploy and manage Azure compute resources
• Implement and manage virtual networking
• Monitor and maintain Azure resources

Sample questions 10 of 100 shown

1. Q1 Manage Azure Identities and Governance (20%)

   What is the difference between a Microsoft Entra ID user and a Microsoft Entra ID guest user (B2B)?

   1. Guest users have full administrative access by default
   2. Guest users are external collaborators invited from other organizations to access resources in your tenant
   3. Guest users cannot access any Azure resources
   4. There is no difference

   B2B (Business-to-Business) guest users are external identities invited to collaborate on your organization's resources. They authenticate through their home tenant and access your resources via invitation. Guest users have limited default permissions and must be explicitly granted access. Native users belong to your tenant directly.
2. Q2 Manage Azure Identities and Governance (20%)

   A company needs to enforce multi-factor authentication (MFA) for all administrative roles including Global Administrator. What is the most effective approach?

   1. Send email reminders to administrators
   2. Configure a Conditional Access policy requiring MFA for directory roles
   3. MFA is automatically enforced for all administrators
   4. Ask administrators to manually enable MFA in their profile

   Conditional Access policies provide the most effective enforcement — create a policy targeting directory roles (Global Admin, etc.) requiring MFA. It's evaluated at sign-in and cannot be bypassed by users. Email reminders and manual opt-in are not enforceable. MFA is not automatically enforced (Option C).
3. Q3 Manage Azure Identities and Governance (20%)

   What is the purpose of Azure RBAC (Role-Based Access Control)?

   1. To monitor network traffic in Azure VNets
   2. To provide fine-grained access management to Azure resources based on assigned roles
   3. To encrypt data at rest
   4. To deploy virtual machines

   Azure RBAC controls access to Azure resources (subscription, resource groups, individual resources) by assigning roles (Owner, Contributor, Reader, or custom roles) to security principals (users, groups, service principals, managed identities). It follows the principle of least privilege. RBAC is an authorization system built on Azure Resource Manager (ARM).
4. Q4 Manage Azure Identities and Governance (20%)

   Which built-in Azure RBAC role should be assigned to a user who needs to create and manage virtual machines but should NOT be able to grant access to other users?

   1. Owner
   2. Contributor
   3. Reader
   4. User Access Administrator

   Contributor allows full create, read, update, and delete operations on Azure resources but does NOT grant the ability to assign roles to other users (that requires Owner or User Access Administrator). Owner has full access including role assignment. Reader is read-only. User Access Administrator only manages role assignments, not resources.
5. Q5 Manage Azure Identities and Governance (20%)

   What is the purpose of Azure Policy?

   1. To control user access to resources
   2. To create and enforce rules about resource properties to ensure compliance with organizational standards
   3. To monitor resource performance
   4. To calculate cloud costs

   Azure Policy evaluates resource configurations against defined rules and can deny non-compliant resources, audit violations, or automatically modify resources. Example: "Only allow VMs of size Standard_DS3_v2" or "Require a tag named 'Environment' on all resources." RBAC (Option A) controls who can access. Policy controls what they can create.
6. Q6 Manage Azure Identities and Governance (20%)

   A company needs to organize 25 Azure subscriptions for governance and billing. How should they structure their subscriptions?

   1. Keep all subscriptions at the root level with no hierarchy
   2. Use Management Groups to organize subscriptions hierarchically and apply policies and RBAC at the group level
   3. Create separate Azure AD tenants for each subscription
   4. Merge all subscriptions into one

   Management Groups provide governance above subscriptions — organize them hierarchically (up to 6 levels) and apply Azure Policy and RBAC assignments that cascade down. This enables unified governance across many subscriptions. Flat structure (Option A) requires per-subscription management. Separate tenants (Option C) fragment identity management.
7. Q7 Manage Azure Identities and Governance (20%)

   What is a resource group in Azure?

   1. A collection of Azure subscriptions
   2. A logical container that holds related Azure resources, enabling management, deployment, and access control as a group
   3. A security boundary for network traffic
   4. A billing category for cost management

   Resource groups are logical containers for resources that share the same lifecycle. You can deploy, manage, and delete related resources together. RBAC roles assigned at the resource group scope apply to all resources within it. Resources can belong to only one resource group but can be in different regions.
8. Q8 Manage Azure Identities and Governance (20%)

   A user has been assigned the Reader role on a resource group and the Contributor role on a specific VM within that group. What permissions does the user have on that VM?

   1. Read only (Reader takes precedence)
   2. Full read, write, and delete (Contributor — the most permissive effective permission applies)
   3. No access
   4. Owner access

   Azure RBAC uses an additive model — the effective permissions are the union of all assigned roles. Reader on the RG + Contributor on the VM = Contributor on the VM (create, read, update, delete). Any explicitly assigned Deny takes precedence (via Azure Blueprints resource locks or explicit deny assignments), but standard RBAC assignments are additive.
9. Q9 Manage Azure Identities and Governance (20%)

   What is the difference between a subscription and a management group?

   1. Management groups contain subscriptions and provide a higher-level governance scope; subscriptions are billing and access boundaries for resources
   2. Subscriptions contain management groups
   3. They are the same thing
   4. Management groups only control billing

   Subscriptions are billing boundaries (each subscription gets a bill) and access boundaries (each subscription can have different admins). Management Groups sit above subscriptions, providing governance (policy, RBAC) that cascades to all subscriptions in the hierarchy. A management group can contain multiple subscriptions and nested management groups.
10. Q10 Manage Azure Identities and Governance (20%)

    A developer accidentally has Contributor access to a production resource group. According to least privilege, what should be done?

    1. Nothing — developers should always have Contributor access
    2. Remove Contributor access and assign only the specific roles/permissions needed for the developer's actual tasks
    3. Assign the Owner role instead
    4. Delete the developer's account

    Least privilege means granting only the minimum necessary permissions. If a developer only deploys code and doesn't manage infrastructure, they may only need Developer/Deployer roles or custom RBAC with narrower scope. Removing excessive Contributor access reduces the blast radius of errors or compromised credentials.

Answer all 100 questions with instant feedback →

Reader reviews 388 ratings

• First time using online prep for a certification. The AZ-104 questions were clear, accurate, and well worth the price.

  ★★★★★★ Abigail M.

• Passed the AZ-104 certification exam after studying this material for three weekends. Very efficient way to prepare.

  ★★★★★★ Xavier H.

• AZ-104 is no joke but this question bank prepares you well. The detailed rationales made sure I understood every concept.

  ★★★★★★ Savannah R.

• Got 856 out of 900 on the AZ-104 exam. This question bank was my primary study resource. Highly recommend.

  ★★★★★ Alyssa D.

• Between the AZ-104 practice questions and some hands-on labs, I felt fully prepared walking into the exam center.

  ★★★★★★ Caleb B.

• Great Microsoft exam preparation tool. The AZ-104 questions are current and the interface is clean and easy to use.

  ★★★★★★ Chris D.

Frequently asked questions

Free study resources

Community-verified analysis of 57 questions from real test-taker discussions — 11 deep analyses and 0 FAQs.

More Microsoft exams