Microsoft AZ-104 · Azure Administrator · Updated 2026
Free AZ-104 Azure Administrator Practice Exam (2026)
Full-length AZ-104 mock exams with a realistic number of questions and the real exam time. Admin scenarios across identity, storage, compute, networking and monitoring, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
50 questions · 1 hour 40 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 5
🏆
Question 1Storage
Your company must keep its data in one Azure region for data-residency reasons. The data must stay available if a single availability zone in that region fails. You need the lowest-cost redundancy option that meets both requirements. Which option should you choose?
Correct answer: C. Zone-redundant storage (ZRS)
ZRS copies data synchronously across three availability zones in the primary region, so a zone outage does not stop access and the data never leaves the region. GZRS also survives a zone failure, but it copies data to a secondary region, which breaks the residency rule and costs more.
ZRS copies data synchronously across three availability zones in the primary region, so a zone outage does not stop access and the data never leaves the region. GZRS also survives a zone failure, but it copies data to a secondary region, which breaks the residency rule and costs more.
Question 2Identities & Governance
Contoso is onboarding 400 new employees whose details are in a spreadsheet. You need to create their Microsoft Entra user accounts from the Microsoft Entra admin center with the least administrative effort. What should you use?
Correct answer: B. Bulk create users with a CSV template
Bulk create uses a CSV template to create many member accounts in one operation. Bulk invite creates B2B guest accounts for external people, not member accounts for employees. Entra Connect Sync only applies when the accounts already exist in an on-premises Active Directory.
Bulk create uses a CSV template to create many member accounts in one operation. Bulk invite creates B2B guest accounts for external people, not member accounts for employees. Entra Connect Sync only applies when the accounts already exist in an on-premises Active Directory.
Question 3Compute
You are writing a Bicep file that must create two resource groups named RG-App and RG-Data in a subscription and then deploy resources into them. The deployment fails because resource groups cannot be created at the scope being used. What should you do?
Correct answer: D. Set targetScope to 'subscription' and deploy with az deployment sub create
Resource groups are subscription-level resources, so the Bicep file must use targetScope = 'subscription' and be deployed with a subscription-level command, and modules can then target each new group. A resource group deployment cannot create resource groups, and dependsOn only sets deployment order.
Resource groups are subscription-level resources, so the Bicep file must use targetScope = 'subscription' and be deployed with a subscription-level command, and modules can then target each new group. A resource group deployment cannot create resource groups, and dependsOn only sets deployment order.
Question 4Virtual Networking
You plan to deploy 60 virtual machines to a new subnet in VNet1. Each VM needs one private IP address. You need to use the smallest possible subnet. Which subnet prefix should you use?
Correct answer: A. /25
A /25 has 128 addresses, and after Azure reserves 5 per subnet, 123 remain for VMs. A /26 looks right at 64 addresses, but only 59 are usable after the 5 reserved ones, which is one short of 60.
A /25 has 128 addresses, and after Azure reserves 5 per subnet, 123 remain for VMs. A /26 looks right at 64 addresses, but only 59 are usable after the 5 reserved ones, which is one short of 60.
Question 5Storage
A web app uses a managed identity to access a storage account. Security policy forbids signing any SAS token with a storage account key. The app must give clients short-lived read access to blobs. Which type of SAS should the app issue?
Correct answer: B. A user delegation SAS for each blob
A user delegation SAS is signed with a user delegation key that the app requests with its Microsoft Entra identity, so no account key is used. A stored access policy makes a service SAS easier to revoke, but that token is still signed with an account key.
A user delegation SAS is signed with a user delegation key that the app requests with its Microsoft Entra identity, so no account key is used. A stored access policy makes a service SAS easier to revoke, but that token is still signed with an account key.
Question 6Identities & Governance
Fabrikam wants every user whose Department attribute is set to Sales to be added to a security group automatically and removed when the attribute changes. What should you configure for the group?
Correct answer: A. Dynamic User membership type with a rule
A Dynamic User group evaluates a rule such as user.department -eq 'Sales' and adds or removes members automatically. Dynamic Device rules evaluate device attributes, so they cannot match a user's department. Dynamic membership requires Microsoft Entra ID P1 or higher.
A Dynamic User group evaluates a rule such as user.department -eq 'Sales' and adds or removes members automatically. Dynamic Device rules evaluate device attributes, so they cannot match a user's department. Dynamic membership requires Microsoft Entra ID P1 or higher.
Question 7Compute
Three months ago, a colleague deployed a storage account and a virtual network to RG-Prod by using an ARM template that was never saved to source control. You need to retrieve that original template and the parameter values that were used. What should you use?
Correct answer: D. The Deployments blade of the resource group
The Deployments blade keeps the deployment history of the resource group, and each entry shows the exact template and parameters that were used. Export template generates a new template from the current state of the resources, so it is not the original file and does not include the original parameter values.
The Deployments blade keeps the deployment history of the resource group, and each entry shows the exact template and parameters that were used. Export template generates a new template from the current state of the resources, so it is not the original file and does not include the original parameter values.
Question 8Virtual Networking
VNet1 in East US is peered with VNet2 in Central US. VNet2 is peered with VNet3 in West Europe. VMs in VNet1 cannot reach VMs in VNet3. You need to enable this communication with the least administrative effort. What should you do?
Correct answer: A. Create a peering between VNet1 and VNet3
VNet peering is not transitive, so traffic does not flow from VNet1 through VNet2 to VNet3, and a direct global peering between VNet1 and VNet3 is the simplest fix. Allow forwarded traffic only helps when an NVA in VNet2 routes the traffic and user-defined routes point to it.
VNet peering is not transitive, so traffic does not flow from VNet1 through VNet2 to VNet3, and a direct global peering between VNet1 and VNet3 is the simplest fix. Allow forwarded traffic only helps when an NVA in VNet2 routes the traffic and user-defined routes point to it.
Question 9Storage
You plan to give a partner several service SAS tokens for a blob container. You must be able to revoke all of the tokens at once later, without rotating the storage account keys. What should you do when you create the tokens?
Correct answer: C. Link the tokens to a stored access policy on the container
When a service SAS references a stored access policy, you can revoke every token tied to it by deleting or changing that policy on the container. A key expiration policy only reminds you to rotate keys, and rotating keys is what you want to avoid.
When a service SAS references a stored access policy, you can revoke every token tied to it by deleting or changing that policy on the container. A key expiration policy only reminds you to rotate keys, and rotating keys is what you want to avoid.
Question 10Identities & Governance
Litware needs to give employees of a partner company access to an app registered in its Microsoft Entra tenant. The partner users must sign in with their own work accounts. What should you do?
Correct answer: A. Invite the partner users as B2B guest users
B2B collaboration adds external users as guests who authenticate with their home organization's credentials. Creating member accounts would give them a second password and leave you managing their account lifecycle. Entra Connect Sync only syncs your own on-premises directory.
B2B collaboration adds external users as guests who authenticate with their home organization's credentials. Creating member accounts would give them a second password and leave you managing their account lifecycle. Entra Connect Sync only syncs your own on-premises directory.
Question 11Compute
You deploy 12 virtual machines to an availability set that is configured with 2 fault domains and 5 update domains. During planned platform maintenance, what is the maximum number of these VMs that can be unavailable at the same time?
Correct answer: D. 3 VMs
Planned maintenance updates one update domain at a time, and 12 VMs across 5 update domains are grouped as 3, 3, 2, 2 and 2, so at most 3 VMs restart together. The value of 6 describes a fault domain failure, which is an unplanned hardware event.
Planned maintenance updates one update domain at a time, and 12 VMs across 5 update domains are grouped as 3, 3, 2, 2 and 2, so at most 3 VMs restart together. The value of 6 describes a fault domain failure, which is an unplanned hardware event.
Question 12Storage
An auditor needs a 2 GB blob that is stored in the Archive tier as soon as possible. What should you do?
Correct answer: B. Change the tier to Hot with High rehydrate priority
Archived blobs are offline and must be rehydrated to an online tier before anyone can read them. High priority can finish in under an hour for blobs smaller than 10 GB, while Standard priority can take up to 15 hours.
Archived blobs are offline and must be rehydrated to an online tier before anyone can read them. High priority can finish in under an hour for blobs smaller than 10 GB, while Standard priority can take up to 15 hours.
Question 13Virtual Networking
HubVNet contains a VPN gateway connected to your on-premises network. SpokeVNet is peered with HubVNet, and you enabled Allow gateway transit on the HubVNet side of the peering. You need VMs in SpokeVNet to reach on-premises resources through the hub gateway. What should you configure on the SpokeVNet side of the peering?
Correct answer: C. Use remote gateways
Use remote gateways on the spoke side lets SpokeVNet send traffic through the hub's VPN gateway, and it pairs with Allow gateway transit on the hub side. Enabling Allow gateway transit on the spoke is wrong because the spoke has no gateway to share.
Use remote gateways on the spoke side lets SpokeVNet send traffic through the hub's VPN gateway, and it pairs with Allow gateway transit on the hub side. Enabling Allow gateway transit on the spoke is wrong because the spoke has no gateway to share.
Question 14Storage
You need a lifecycle management rule that moves block blobs to the Cool tier when they have not been read for 60 days. What must you do first?
Correct answer: B. Enable access time tracking on the account
Rules that use daysAfterLastAccessTimeGreaterThan only work after access time tracking is turned on, because otherwise Azure does not record when a blob is read. The change feed logs create, update and delete events, but lifecycle management does not use it to measure reads.
Rules that use daysAfterLastAccessTimeGreaterThan only work after access time tracking is turned on, because otherwise Azure does not record when a blob is read. The change feed logs create, update and delete events, but lifecycle management does not use it to measure reads.
Question 15Identities & Governance
User1 must be able to grant other users access to virtual machines in a resource group named RG1. User1 must not be able to create, modify, or delete any resources in RG1. Which built-in role should you assign to User1 on RG1?
Correct answer: D. User Access Administrator
User Access Administrator lets a user manage role assignments without permission to manage the resources themselves. Owner can also assign roles, but it would let User1 create, change, and delete resources. Contributor and Virtual Machine Contributor cannot assign roles at all.
User Access Administrator lets a user manage role assignments without permission to manage the resources themselves. Owner can also assign roles, but it would let User1 create, change, and delete resources. Contributor and Virtual Machine Contributor cannot assign roles at all.
Question 16Compute
VM1 runs in an availability set with three other VMs. You need to resize VM1 to a size from a different VM family, but that size does not appear in the list of available sizes while VM1 is running. What should you do first?
Correct answer: B. Stop and deallocate all of the VMs in the availability set
If the new size is not available on the hardware cluster that hosts the availability set, all VMs in the set must be deallocated so the set can be placed on a cluster that offers that size. Redeploy is meant for host or connectivity problems and does not remove the availability set's cluster limit.
If the new size is not available on the hardware cluster that hosts the availability set, all VMs in the set must be deallocated so the set can be placed on a cluster that offers that size. Redeploy is meant for host or connectivity problems and does not remove the availability set's cluster limit.
Question 17Storage
You plan to configure object replication from a source storage account to a destination account in another region. Which configuration is required before you create the replication policy?
Correct answer: C. Blob versioning on both accounts and change feed on the source
Object replication reads the change feed of the source account and needs blob versioning turned on in both accounts. Versioning on the destination alone is not enough, and accounts with a hierarchical namespace are not supported for object replication.
Object replication reads the change feed of the source account and needs blob versioning turned on in both accounts. Versioning on the destination alone is not enough, and accounts with a hierarchical namespace are not supported for object replication.
Question 18Virtual Networking
An NSG associated with Subnet1 has two custom inbound rules: priority 100 denies TCP 3389 from Any, and priority 200 allows TCP 3389 from 10.0.5.0/24. Administrators in 10.0.5.0/24 cannot connect to VMs by using RDP. You need to allow their connections without opening RDP to other sources. What should you do?
Correct answer: A. Change the deny rule priority to 300
NSG rules are processed from the lowest priority number up, and processing stops at the first match, so moving the deny rule to 300 lets the allow rule at 200 match first. Setting the allow rule to 50 is not possible because custom rule priorities must be between 100 and 4096.
NSG rules are processed from the lowest priority number up, and processing stops at the first match, so moving the deny rule to 300 lets the allow rule at 200 match first. Setting the allow rule to 50 is not possible because custom rule priorities must be between 100 and 4096.
Question 19Identities & Governance
Admin1 has the Contributor role on a subscription named Sub1. Admin1 tries to give a colleague the Reader role on a resource group in Sub1, but the operation fails. What is the most likely reason?
Correct answer: D. Contributor does not allow creating role assignments
Contributor grants full resource management but excludes Microsoft.Authorization/roleAssignments/write, so it cannot grant access to others. Global Administrator is an Entra role and is not needed to assign Azure roles; roles such as Owner or User Access Administrator are. Reader can be assigned at any scope.
Contributor grants full resource management but excludes Microsoft.Authorization/roleAssignments/write, so it cannot grant access to others. Global Administrator is an Entra role and is not needed to assign Azure roles; roles such as Owner or User Access Administrator are. Reader can be assigned at any scope.
Question 20Compute
You try to enable Azure Disk Encryption on a Windows VM named VM2 by using a key vault named KV1 in the same region and subscription. The operation fails with an error stating that KV1 is not enabled for disk encryption. What should you do?
Correct answer: A. Turn on the Azure Disk Encryption for volume encryption setting on KV1
Azure Disk Encryption can only store keys and secrets in a vault that has the Azure Disk Encryption for volume encryption access setting turned on. A role for your user account does not grant this platform access, and the vault only needs to be in the same region and subscription, not the same resource group.
Azure Disk Encryption can only store keys and secrets in a vault that has the Azure Disk Encryption for volume encryption access setting turned on. A role for your user account does not grant this platform access, and the vault only needs to be in the same region and subscription, not the same resource group.
Question 21Storage
A storage account is set up for identity-based access to Azure Files with on-premises AD DS. Members of a group must read, write and delete files in a share, but must not change Windows ACLs. Following least privilege, which share-level role should you assign?
Correct answer: C. Storage File Data SMB Share Contributor
Storage File Data SMB Share Contributor gives read, write and delete access to the share over SMB. The Elevated Contributor role also lets users change Windows ACLs, which is more than this group needs.
Storage File Data SMB Share Contributor gives read, write and delete access to the share over SMB. The Elevated Contributor role also lets users change Windows ACLs, which is more than this group needs.
Question 22Virtual Networking
You assign a Standard SKU public IP address to the network interface of VM1. No NSG is associated with the network interface or its subnet. You cannot connect to VM1 by using RDP from the internet. What should you do?
Correct answer: D. Create an NSG that allows TCP 3389 and associate it
Standard SKU public IPs are secure by default, so inbound traffic is blocked until an NSG explicitly allows it. Changing to dynamic allocation is not an option because Standard SKU public IPs support only static allocation.
Standard SKU public IPs are secure by default, so inbound traffic is blocked until an NSG explicitly allows it. Changing to dynamic allocation is not an option because Standard SKU public IPs support only static allocation.
Question 23Identities & Governance
A management group named MG1 contains subscriptions Sub1 and Sub2. User1 is assigned Reader on MG1 and Contributor on a resource group named RG1 in Sub1. What can User1 do?
Correct answer: D. Manage resources in RG1 and view all resources in Sub1 and Sub2
Azure RBAC is additive: the Reader assignment on MG1 is inherited by both subscriptions and everything in them, and Contributor adds write access in RG1. A narrower role at a higher scope does not override a broader role at a lower scope. Only deny assignments can block granted permissions.
Azure RBAC is additive: the Reader assignment on MG1 is inherited by both subscriptions and everything in them, and Contributor adds write access in RG1. A narrower role at a higher scope does not override a broader role at a lower scope. Only deny assignments can block granted permissions.
Question 24Compute
You need to move a production VM named VM3, together with its disks, network interface, and virtual network, from the East US region to the West Europe region. You want a guided process that validates dependencies and lets you commit or discard the move. What should you use?
Correct answer: B. Azure Resource Mover with a move collection
Azure Resource Mover moves VMs and their dependent resources between regions, validates dependencies, and lets you commit or discard the move. A resource group move only changes the resource group or subscription and never changes the region of a resource.
Azure Resource Mover moves VMs and their dependent resources between regions, validates dependencies, and lets you commit or discard the move. A resource group move only changes the resource group or subscription and never changes the region of a resource.
Question 25Storage
A branch file server syncs a folder to an Azure file share by using Azure File Sync. The server's local volume is running out of space. Users must still see every file, but only frequently used files should be stored on the server. What should you do?
Correct answer: C. Enable cloud tiering on the server endpoint
Cloud tiering is a server endpoint setting that keeps often-used files on the local disk and replaces the rest with pointers, while users still see the full namespace. The cloud endpoint is the Azure file share itself and has no tiering setting.
Cloud tiering is a server endpoint setting that keeps often-used files on the local disk and replaces the rest with pointers, while users still see the full namespace. The cloud endpoint is the Azure file share itself and has no tiering setting.
Question 26Storage
A nightly script must update a blob container from a local folder. Only new or changed files should be transferred, and files removed from the folder must also be removed from the container. Which AzCopy command should you use?
Correct answer: D. azcopy sync with --delete-destination=true
azcopy sync compares source and destination by last modified time, sends only what changed, and --delete-destination=true removes files that no longer exist at the source. azcopy copy with --overwrite=ifSourceNewer skips unchanged files, but it never deletes anything from the container.
azcopy sync compares source and destination by last modified time, sends only what changed, and --delete-destination=true removes files that no longer exist at the source. azcopy copy with --overwrite=ifSourceNewer skips unchanged files, but it never deletes anything from the container.
Question 27Identities & Governance
Your company requires that resources can be deployed only to East US and West Europe. Deployments to any other region must be blocked when they are submitted. Which Azure Policy effect should the policy use?
Correct answer: C. Deny
Deny rejects a create or update request that does not meet the policy rule, so the deployment fails before the resource exists. Audit only flags the resource as non-compliant and still lets the deployment succeed. The built-in Allowed locations policy uses the Deny effect.
Deny rejects a create or update request that does not meet the policy rule, so the deployment fails before the resource exists. Audit only flags the resource as non-compliant and still lets the deployment succeed. The built-in Allowed locations policy uses the Deny effect.
Question 28Compute
Your company uses Azure Bastion with the Basic SKU. Administrators want to connect to VMs through Bastion by using the native Remote Desktop client on their Windows computers instead of the Azure portal. What should you do?
Correct answer: B. Upgrade Bastion to Standard SKU and enable native client support
Native client support, used with the az network bastion rdp and ssh commands, requires the Standard or Premium SKU and must be enabled in the Bastion configuration. The Developer SKU is more limited than Basic and only supports connections from the portal.
Native client support, used with the az network bastion rdp and ssh commands, requires the Standard or Premium SKU and must be enabled in the Bastion configuration. The Developer SKU is more limited than Basic and only supports connections from the portal.
Question 29Virtual Networking
You need all internet-bound traffic from Subnet1 to pass through a firewall appliance VM that has the private IP address 10.0.9.4. You create a route table with a 0.0.0.0/0 route and associate it with Subnet1. Which next hop type should the route use?
Correct answer: C. Virtual appliance
The Virtual appliance next hop type sends traffic to a specific private IP address, here the firewall VM at 10.0.9.4. Virtual network gateway is for sending traffic to a VPN or ExpressRoute gateway, not to a VM inside the VNet.
The Virtual appliance next hop type sends traffic to a specific private IP address, here the firewall VM at 10.0.9.4. Virtual network gateway is for sending traffic to a VPN or ExpressRoute gateway, not to a VM inside the VNet.
Question 30Monitor & Maintain
You must keep the platform metrics of an Azure Application Gateway for 18 months and query them with KQL together with the gateway's resource logs. What should you do?
Correct answer: A. Send the metrics to a Log Analytics workspace with a diagnostic setting
Platform metrics stay in the Azure Monitor metrics store for 93 days, and that period cannot be changed. A diagnostic setting copies them to a Log Analytics workspace, where you set the retention and can join them with resource logs in KQL. There is no retention setting on the gateway that extends the 93 days.
Platform metrics stay in the Azure Monitor metrics store for 93 days, and that period cannot be changed. A diagnostic setting copies them to a Log Analytics workspace, where you set the retention and can join them with resource logs in KQL. There is no retention setting on the gateway that extends the 93 days.
Question 31Identities & Governance
Resource groups in your subscription have a CostCenter tag. You need new resources to receive the CostCenter value from their resource group automatically when the tag is missing. What should you do?
Correct answer: B. Assign the built-in policy that inherits the resource group tag
Resources do not inherit tags from their resource group by default. The built-in policy 'Inherit a tag from the resource group if missing' uses the Modify effect to add the tag during create or update. A Deny policy would block the deployment instead of adding the tag, and Audit only reports it.
Resources do not inherit tags from their resource group by default. The built-in policy 'Inherit a tag from the resource group if missing' uses the Modify effect to add the tag during create or update. A Deny policy would block the deployment instead of adding the tag, and Audit only reports it.
Question 32Compute
A VM scale set has an autoscale profile with a minimum of 2, a maximum of 10, and a default of 2 instances. The only rule adds one instance when average CPU exceeds 70 percent for 10 minutes. CPU has stayed below 10 percent for two days, but the scale set still runs 6 instances. What is the most likely cause?
Correct answer: A. The profile does not contain a rule that removes instances
Autoscale only removes instances when a scale-in rule tells it to, so a profile with only a scale-out rule keeps the count it reached. A cool down period lasts minutes, not days, and the upgrade policy controls how model changes roll out, not the instance count.
Autoscale only removes instances when a scale-in rule tells it to, so a profile with only a scale-out rule keeps the count it reached. A cool down period lasts minutes, not days, and the upgrade policy controls how model changes roll out, not the instance count.
Question 33Virtual Networking
You plan to deploy Azure Bastion Standard SKU to VNet1 so administrators can connect to VMs that have no public IP addresses. You need to prepare a subnet for the deployment. Which subnet configuration should you use?
Correct answer: C. A subnet named AzureBastionSubnet with a /26 or larger prefix
Azure Bastion Basic, Standard and Premium SKUs need a dedicated subnet named exactly AzureBastionSubnet with a /26 or larger prefix. A /29 uses the right name but is too small, so the deployment fails validation.
Azure Bastion Basic, Standard and Premium SKUs need a dedicated subnet named exactly AzureBastionSubnet with a /26 or larger prefix. A /29 uses the right name but is too small, so the deployment fails validation.
Question 34Monitor & Maintain
You need a KQL query that lists the computers whose most recent heartbeat in a Log Analytics workspace is older than 15 minutes. Which query should you use?
Correct answer: D. Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(15m)
The query must find each computer's latest heartbeat with max(TimeGenerated) first, and then keep only computers where that time is older than 15 minutes. Filtering for records older than 15 minutes before summarizing returns every computer, including the ones that are still reporting.
The query must find each computer's latest heartbeat with max(TimeGenerated) first, and then keep only computers where that time is older than 15 minutes. Filtering for records older than 15 minutes before summarizing returns every computer, including the ones that are still reporting.
Question 35Identities & Governance
Operators must be able to change settings and resize virtual machines in RG-Prod. No one, including subscription owners, should be able to delete RG-Prod or its resources by accident. What should you do?
Correct answer: D. Apply a CanNotDelete lock to RG-Prod
A CanNotDelete lock allows reads and changes but blocks deletion, and it applies to every user regardless of role. A ReadOnly lock would also stop deletion, but it blocks changes such as resizing VMs. Resources in RG-Prod inherit the lock from the resource group.
A CanNotDelete lock allows reads and changes but blocks deletion, and it applies to every user regardless of role. A ReadOnly lock would also stop deletion, but it blocks changes such as resizing VMs. Resources in RG-Prod inherit the lock from the resource group.
Question 36Compute
A developer needs to build a container image from a Dockerfile in a local folder and push it to an Azure container registry named crfabrikam. Docker is not installed on the developer's workstation. Which command should the developer run?
Correct answer: A. az acr build --registry crfabrikam --image app:v1 .
az acr build uses ACR Tasks to upload the build context, build the image in Azure, and push it to the registry, so no local Docker engine is needed. az acr import only copies an existing image from another registry and cannot build from a Dockerfile.
az acr build uses ACR Tasks to upload the build context, build the image in Azure, and push it to the registry, so no local Docker engine is needed. az acr import only copies an existing image from another registry and cannot build from a Dockerfile.
Question 37Monitor & Maintain
The operations team must get an email and an SMS message whenever anyone deletes a virtual machine in a subscription. What should you create?
Correct answer: B. An activity log alert rule for VM deletes with an action group
Deleting a VM is a control-plane operation that is written to the activity log, so an activity log alert rule detects it and its action group sends the email and SMS. An alert processing rule only acts on alerts that other rules fire, so on its own it cannot detect the deletion.
Deleting a VM is a control-plane operation that is written to the activity log, so an activity log alert rule detects it and its action group sends the email and SMS. An alert processing rule only acts on alerts that other rules fire, so on its own it cannot detect the deletion.
Question 38Virtual Networking
On-premises servers connect to VNet1 through a site-to-site VPN. The servers must access a storage account by using a private IP address from VNet1, and public network access to the storage account must be disabled. What should you use?
Correct answer: D. A private endpoint for the storage account
A private endpoint gives the storage account a private IP address in VNet1, which on-premises clients can reach over the VPN even with public access disabled. A service endpoint keeps traffic on the public endpoint and gives on-premises clients no private path to the account.
A private endpoint gives the storage account a private IP address in VNet1, which on-premises clients can reach over the VPN even with public access disabled. A service endpoint keeps traffic on the public endpoint and gives on-premises clients no private path to the account.
Question 39Monitor & Maintain
Every Saturday from 22:00 to 02:00, you patch the VMs in a resource group. Alert rules must keep evaluating during this time, but no notifications should be sent. What should you configure?
Correct answer: C. An alert processing rule with suppression on a weekly schedule
An alert processing rule can suppress action groups for all alerts in a scope on a recurring schedule, while the alerts still fire and appear in the portal. Disabling the alert rules stops evaluation completely and needs manual work every week.
An alert processing rule can suppress action groups for all alerts in a scope on a recurring schedule, while the alerts still fire and appear in the portal. Disabling the alert rules stops evaluation completely and needs manual work every week.
Question 40Identities & Governance
You move a virtual machine and its related resources from RG1 to RG2 in the same subscription. Which statement about the moved resources is true?
Correct answer: B. Their resource IDs change to reflect RG2
The resource group name is part of each resource ID, so the moved resources get new IDs and scripts that use the old IDs must be updated. A move never changes a resource's region, even if RG2 was created in a different region. Both the source and target resource groups are locked during the move.
The resource group name is part of each resource ID, so the moved resources get new IDs and scripts that use the old IDs must be updated. A move never changes a resource's region, even if RG2 was created in a different region. Both the source and target resource groups are locked during the move.
Question 41Compute
You deploy a queue-processing worker to Azure Container Apps. The app must add replicas as the number of messages in an Azure Service Bus queue grows and must run no replicas when the queue is empty. What should you configure?
Correct answer: C. A custom azure-servicebus scale rule with minimum replicas of 0
Container Apps supports KEDA-based custom scale rules, and the azure-servicebus scaler adds replicas based on queue length; a minimum of 0 lets the app scale to zero when the queue is empty. CPU-based rules cannot scale an app to zero, and HTTP rules react to web requests, not queued messages.
Container Apps supports KEDA-based custom scale rules, and the azure-servicebus scaler adds replicas based on queue length; a minimum of 0 lets the app scale to zero when the queue is empty. CPU-based rules cannot scale an app to zero, and HTTP rules react to web requests, not queued messages.
Question 42Monitor & Maintain
Users cannot connect over RDP from the public IP address 203.0.113.25 to an Azure VM. You need to find out whether a network security group rule blocks this traffic and which rule it is. Which Network Watcher tool should you use?
Correct answer: A. IP flow verify
IP flow verify checks a packet with a given IP address, port and protocol against the NSG rules on the VM's network interface and names the rule that allows or denies it. Connection troubleshoot runs tests from an Azure source such as a VM, so it cannot test traffic that starts from an internet address.
IP flow verify checks a packet with a given IP address, port and protocol against the NSG rules on the VM's network interface and names the rule that allows or denies it. Connection troubleshoot runs tests from an Azure source such as a VM, so it cannot test traffic that starts from an internet address.
Question 43Virtual Networking
You create a private DNS zone named corp.internal. You need VMs in VNet1 to have their DNS A records created and removed in the zone automatically. What should you do?
Correct answer: B. Add a virtual network link with auto-registration enabled
Linking the private zone to VNet1 with auto-registration enabled makes Azure create, update and remove A records for VMs in that VNet. A DNS forwarding ruleset only controls where queries are sent and never creates records.
Linking the private zone to VNet1 with auto-registration enabled makes Azure create, update and remove A records for VMs in that VNet. A DNS forwarding ruleset only controls where queries are sent and never creates records.
Question 44Identities & Governance
Finance wants the subscription owner to receive an email when actual monthly spend for a subscription reaches 80 percent of 5,000 USD. What should you configure?
Correct answer: A. A Cost Management budget with an alert condition
A Cost Management budget tracks actual or forecasted spend and sends email alerts when a threshold such as 80 percent is reached. Azure Monitor metric alerts track resource metrics like CPU, not billing totals. Advisor digests summarize recommendations and do not track a spending limit.
A Cost Management budget tracks actual or forecasted spend and sends email alerts when a threshold such as 80 percent is reached. Azure Monitor metric alerts track resource metrics like CPU, not billing totals. Advisor digests summarize recommendations and do not track a spending limit.
Question 45Compute
A web app has production and staging deployment slots. The staging slot uses an app setting that points to a test database. You need to ensure that this setting stays with the staging slot when you swap the slots. What should you do?
Correct answer: C. Mark the app setting as a deployment slot setting in staging
Settings marked as deployment slot settings are sticky, so they stay with their slot instead of moving with the app during a swap. A Key Vault reference only changes where the value is stored, and without the slot setting flag it still swaps with the content.
Settings marked as deployment slot settings are sticky, so they stay with their slot instead of moving with the app during a swap. A Key Vault reference only changes where the value is stored, and without the slot setting flag it still swaps with the content.
Question 46Monitor & Maintain
You need to protect Azure managed disks by using Azure Disk Backup, which takes scheduled incremental snapshots. Which resource must you create to hold the backup policy and the backup instances?
Correct answer: B. A Backup vault
Azure Disk Backup uses a Backup vault, which is the vault type for workloads such as Azure Disks and Azure Blobs. A Recovery Services vault protects Azure VMs, SQL Server in Azure VMs, Azure Files and MARS, but it is not used for Azure Disk Backup.
Azure Disk Backup uses a Backup vault, which is the vault type for workloads such as Azure Disks and Azure Blobs. A Recovery Services vault protects Azure VMs, SQL Server in Azure VMs, Azure Files and MARS, but it is not used for Azure Disk Backup.
Question 47Virtual Networking
You host a web app on VMs in one Azure region. Requests for /images/* must go to one backend pool and requests for /api/* must go to another. The solution must include a web application firewall and must stay within the region. What should you use?
Correct answer: D. Azure Application Gateway WAF v2
Application Gateway is a regional layer 7 load balancer that supports URL path-based routing, and the WAF v2 SKU adds a web application firewall. Front Door also routes by path and offers WAF, but it is a global edge service, which does not fit a single-region requirement.
Application Gateway is a regional layer 7 load balancer that supports URL path-based routing, and the WAF v2 SKU adds a web application firewall. Front Door also routes by path and offers WAF, but it is a global edge service, which does not fit a single-region requirement.
Question 48Identities & Governance
Contoso has 15 subscriptions for one business unit. You need to assign an Azure Policy once so that it applies to all 15 subscriptions and to any subscription added to the same group later. What should you do?
Correct answer: A. Assign the policy to a management group containing them
Policy and RBAC assignments on a management group are inherited by every subscription under it, including subscriptions moved in later. A script works but must be rerun every time a subscription is added. Policies are assigned to scopes, not to groups of users.
Policy and RBAC assignments on a management group are inherited by every subscription under it, including subscriptions moved in later. A script works but must be rerun every time a subscription is added. Policies are assigned to scopes, not to groups of users.
Question 49Compute
An App Service web app must connect to a SQL Server instance that runs on a VM with only a private IP address in VNet1. You need to enable outbound connectivity from the web app to VNet1. What should you configure?
Correct answer: B. Regional VNet integration with a dedicated delegated subnet
Regional VNet integration gives the app outbound access into the VNet and needs a dedicated subnet delegated to Microsoft.Web/serverFarms. A private endpoint only handles inbound traffic to the app, so it does not let the app reach the SQL Server VM.
Regional VNet integration gives the app outbound access into the VNet and needs a dedicated subnet delegated to Microsoft.Web/serverFarms. A private endpoint only handles inbound traffic to the app, so it does not let the app reach the SQL Server VM.
Question 50Monitor & Maintain
You used Azure Site Recovery to fail over Azure VMs from East US to West US and committed the failover. East US is healthy again. You need to prepare to fail back to East US. What should you do first?
Correct answer: D. Reprotect the VMs to replicate from West US to East US
After a failover, the VMs in West US are not protected until you reprotect them, which starts replication back to East US. A failover to East US is only possible after that reverse replication is in place.
After a failover, the VMs in West US are not protected until you reprotect them, which starts replication back to East US. A failover to East US is only possible after that reverse replication is in place.
The real AZ-104 exam at a glance
50questions
1h 40mtime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Microsoft Azure & Power BI practice tests
AZ-900 Practice Test50 questions · Azure FundamentalsAZ-305 Practice Test50 questions · Azure Solutions ArchitectAZ-400 Practice Test50 questions · Azure DevOps EngineerPL-300 Practice Test50 questions · Power BI Data Analyst
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AZ-104 exam. They are not real exam questions. AZ-104 and Microsoft are trademarks of their owners. Real exam format: usually 40-60 questions · 100 minutes · passing score 700 on a 1-1000 scale · the real exam can include case studies and other question types.