AZ-104 — Microsoft Azure Administrator
Microsoft

Microsoft Azure Administrator (AZ-104) Practice Questions

★★★★★★ 4.8 359 verified reviews
100 questions
June 11, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Manage Azure identities and governance
  • Implement and manage storage
  • Deploy and manage Azure compute resources
  • Implement and manage virtual networking
  • Monitor and maintain Azure resources

Sample Questions (10 of 100 shown)

Q1 Manage Azure Identities and Governance (20%)
What is the difference between a Microsoft Entra ID user and a Microsoft Entra ID guest user (B2B)?
  1. Guest users have full administrative access by default
  2. Guest users are external collaborators invited from other organizations to access resources in your tenant
  3. Guest users cannot access any Azure resources
  4. There is no difference
✓ Correct Answer: B
B2B (Business-to-Business) guest users are external identities invited to collaborate on your organization's resources. They authenticate through their home tenant and access your resources via invitation. Guest users have limited default permissions and must be explicitly granted access. Native users belong to your tenant directly.
Q2 Manage Azure Identities and Governance (20%)
A company needs to enforce multi-factor authentication (MFA) for all administrative roles including Global Administrator. What is the most effective approach?
  1. Send email reminders to administrators
  2. Configure a Conditional Access policy requiring MFA for directory roles
  3. MFA is automatically enforced for all administrators
  4. Ask administrators to manually enable MFA in their profile
✓ Correct Answer: B
Conditional Access policies provide the most effective enforcement — create a policy targeting directory roles (Global Admin, etc.) requiring MFA. It's evaluated at sign-in and cannot be bypassed by users. Email reminders and manual opt-in are not enforceable. MFA is not automatically enforced (Option C).
Q3 Manage Azure Identities and Governance (20%)
What is the purpose of Azure RBAC (Role-Based Access Control)?
  1. To monitor network traffic in Azure VNets
  2. To provide fine-grained access management to Azure resources based on assigned roles
  3. To encrypt data at rest
  4. To deploy virtual machines
✓ Correct Answer: B
Azure RBAC controls access to Azure resources (subscription, resource groups, individual resources) by assigning roles (Owner, Contributor, Reader, or custom roles) to security principals (users, groups, service principals, managed identities). It follows the principle of least privilege. RBAC is an authorization system built on Azure Resource Manager (ARM).
Q4 Manage Azure Identities and Governance (20%)
Which built-in Azure RBAC role should be assigned to a user who needs to create and manage virtual machines but should NOT be able to grant access to other users?
  1. Owner
  2. Contributor
  3. Reader
  4. User Access Administrator
✓ Correct Answer: B
Contributor allows full create, read, update, and delete operations on Azure resources but does NOT grant the ability to assign roles to other users (that requires Owner or User Access Administrator). Owner has full access including role assignment. Reader is read-only. User Access Administrator only manages role assignments, not resources.
Q5 Manage Azure Identities and Governance (20%)
What is the purpose of Azure Policy?
  1. To control user access to resources
  2. To create and enforce rules about resource properties to ensure compliance with organizational standards
  3. To monitor resource performance
  4. To calculate cloud costs
✓ Correct Answer: B
Azure Policy evaluates resource configurations against defined rules and can deny non-compliant resources, audit violations, or automatically modify resources. Example: "Only allow VMs of size Standard_DS3_v2" or "Require a tag named 'Environment' on all resources." RBAC (Option A) controls who can access. Policy controls what they can create.
Q6 Manage Azure Identities and Governance (20%)
A company needs to organize 25 Azure subscriptions for governance and billing. How should they structure their subscriptions?
  1. Keep all subscriptions at the root level with no hierarchy
  2. Use Management Groups to organize subscriptions hierarchically and apply policies and RBAC at the group level
  3. Create separate Azure AD tenants for each subscription
  4. Merge all subscriptions into one
✓ Correct Answer: B
Management Groups provide governance above subscriptions — organize them hierarchically (up to 6 levels) and apply Azure Policy and RBAC assignments that cascade down. This enables unified governance across many subscriptions. Flat structure (Option A) requires per-subscription management. Separate tenants (Option C) fragment identity management.
Q7 Manage Azure Identities and Governance (20%)
What is a resource group in Azure?
  1. A collection of Azure subscriptions
  2. A logical container that holds related Azure resources, enabling management, deployment, and access control as a group
  3. A security boundary for network traffic
  4. A billing category for cost management
✓ Correct Answer: B
Resource groups are logical containers for resources that share the same lifecycle. You can deploy, manage, and delete related resources together. RBAC roles assigned at the resource group scope apply to all resources within it. Resources can belong to only one resource group but can be in different regions.
Q8 Manage Azure Identities and Governance (20%)
A user has been assigned the Reader role on a resource group and the Contributor role on a specific VM within that group. What permissions does the user have on that VM?
  1. Read only (Reader takes precedence)
  2. Full read, write, and delete (Contributor — the most permissive effective permission applies)
  3. No access
  4. Owner access
✓ Correct Answer: B
Azure RBAC uses an additive model — the effective permissions are the union of all assigned roles. Reader on the RG + Contributor on the VM = Contributor on the VM (create, read, update, delete). Any explicitly assigned Deny takes precedence (via Azure Blueprints resource locks or explicit deny assignments), but standard RBAC assignments are additive.
Q9 Manage Azure Identities and Governance (20%)
What is the difference between a subscription and a management group?
  1. Management groups contain subscriptions and provide a higher-level governance scope; subscriptions are billing and access boundaries for resources
  2. Subscriptions contain management groups
  3. They are the same thing
  4. Management groups only control billing
✓ Correct Answer: A
Subscriptions are billing boundaries (each subscription gets a bill) and access boundaries (each subscription can have different admins). Management Groups sit above subscriptions, providing governance (policy, RBAC) that cascades to all subscriptions in the hierarchy. A management group can contain multiple subscriptions and nested management groups.
Q10 Manage Azure Identities and Governance (20%)
A developer accidentally has Contributor access to a production resource group. According to least privilege, what should be done?
  1. Nothing — developers should always have Contributor access
  2. Remove Contributor access and assign only the specific roles/permissions needed for the developer's actual tasks
  3. Assign the Owner role instead
  4. Delete the developer's account
✓ Correct Answer: B
Least privilege means granting only the minimum necessary permissions. If a developer only deploys code and doesn't manage infrastructure, they may only need Developer/Deployer roles or custom RBAC with narrower scope. Removing excessive Contributor access reduces the blast radius of errors or compromised credentials.

You've viewed 3 of 100 questions. Start the free practice exam to answer all questions with instant feedback.

What Our Customers Say 359 verified reviews

4.8 ★★★★★★ Based on 359 reviews
★★★★★
I passed AZ-104 on my first try thanks to these practice questions. The unlimited retakes were essential for building confidence.
— Nicole K.
★★★★★★
I used this for three months on and off for AZ-104. The progress tracker helped me stay consistent.
— Hannah K.
★★★★★★
I work full time and study at night. The AZ-104 question bank allowed me to learn efficiently without wasting precious time.
— Harper S.
★★★★★★
I bought access for the AZ-104 exam as a gift for my brother. He passed on his first try and said the questions were spot-on.
— Cameron J.
★★★★★
Passed AZ-104 with 912/1000. The practice questions cover the exam objectives thoroughly and the explanations are clear.
— Ella M.
★★★★★★
The AZ-104 explanations are detailed and educational. I learned more from reviewing wrong answers than from any book.
— Rachel S.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

Virtual networking consistently causes the most failures. The exam presents complex network topologies and asks you to calculate effective security rules when NSGs, ASGs, and custom UDRs interact — you cannot rely on memorization, you must trace packet flow. Storage security (SAS token scoping and expiry) and Bicep/ARM template syntax tracking are also frequent stumbling points. Practice with real scenario questions that force you to choose between redundant storage options under a specific failure scenario, and calculate effective NSG rules for a given VNet peering configuration.

Do not rely on Microsoft Learn to pass. The integrated documentation is useful for checking exact PowerShell or Azure CLI syntax, but the exam timer does not pause while you browse. With roughly two minutes per question, looking up more than four or five answers will cause you to run out of time. Furthermore, the exam interface disables Ctrl+F page search, making navigation slower than you expect. Use Learn as a safety net, not a primary strategy.

If your score falls below 700 on your first attempt, you must wait 24 hours before rescheduling. For a third, fourth, or fifth attempt, a mandatory 14-day waiting period applies between bookings. Microsoft caps you at five attempts within any rolling 12-month window, and each retake requires full payment of the $165 exam fee.

The credential is valid for one year from your exam date. Within 180 days before expiration, you can renew for free by passing an unproctored, open-book renewal assessment on Microsoft Learn that covers only the features added in the past year. No retesting of the full exam is required.

Our mock exam reproduces the AZ-104 question formats you will encounter: single-choice, multiple-response, drag-and-drop sequencing, hot area diagrams, drop-down script completions (PowerShell and Azure CLI), and case studies with locked navigation. The practice test enforces the same 120-minute timer and presents scenario questions that require you to calculate effective NSG rules, choose the correct RBAC role, and write Bicep template snippets — the same skills measured in the real exam.

Yes, the complete question bank is available as a downloadable PDF that packages all five domains in the same weighted distribution as the real exam. The PDF includes detailed answer explanations with references to official Azure documentation, Bicep template examples, and KQL query samples for Azure Monitor. You can use the PDF to review Azure RBAC role assignments, virtual network UDR configuration steps, and Azure Site Recovery failover procedures while commuting or in environments without internet access.

Start by building a small lab environment where you can deploy a VNet with subnets, assign RBAC roles to test effective permissions, and configure an NSG to block specific traffic — then verify the result using Network Watcher. Practice writing Bicep templates that deploy a VM with a managed disk and a storage account with a private endpoint. When you can complete these tasks without documentation, the scenario questions become straightforward applications of your hands-on experience. Focus especially on overlapping NSG rules and UDR route precedence, because the exam presents multi-layered network diagrams and asks you to trace exactly one packet.

Free Study Resources

Community-verified analysis of 42 topics from real test-taker discussions — 11 deep analyses and 0 FAQs.

Full Study Guide 42 topics, exam overview & domain breakdown Most Debated Topics Ranked by community disagreement