kwizza
Microsoft

Microsoft Azure Administrator (AZ-104) practice questions

8 sample questions from our 300-question Azure Administrator bank — one from each official domain, with the answer and a full explanation under each. Every question is original, written against the published exam objectives, and quality-checked before it reaches you.

AZ-104AssociateIntermediate

Question 1 · Manage Azure identities and governance

Thornbury Logistics has a management group named mg-thornbury containing two subscriptions. A policy assignment at the management group denies creation of storage accounts outside Canada Central. The finance team needs one storage account in East US in the subscription sub-fin-02 for a 30-day data exchange with an auditor. Which approach lets that single account be created while keeping the restriction everywhere else?

  1. A.Add a Deny assignment on sub-fin-02 that overrides the management group assignment
  2. B.Change the policy definition effect from Deny to Audit for the duration of the exchange
  3. C.Move sub-fin-02 out of mg-thornbury into the tenant root group for 30 days
  4. D.Create an exemption of category Waiver on the target resource group, scoped to that policy assignment, with an expiration date
Show answer & explanation

Answer: D

A policy exemption scoped to a resource group suppresses evaluation of a specific assignment for that scope only, and it supports an expiresOn date so the restriction resumes automatically. Changing the effect to Audit would remove enforcement across every subscription under the management group, not just the one resource group that needs the carve-out.

Question 2 · Implement and manage storage

Delacroix Imaging stores 6 TB of scanned records in a general-purpose v2 account. Records are read constantly for the first 60 days, occasionally for the next 9 months, and then essentially never, though a regulator can demand any record with 12 hours notice. Which lifecycle design fits best?

  1. A.A lifecycle management rule moving blobs to archive after 60 days and rehydrating on demand
  2. B.A lifecycle management rule moving blobs to cool after 60 days and to archive after 300 days
  3. C.Move the entire account's default access tier to cool and enable versioning
  4. D.Keep all blobs in hot and enable point-in-time restore for the container
Show answer & explanation

Answer: B

Cool suits data read occasionally within a 30-day-minimum retention window, and archive suits data that is effectively never read, with standard rehydration completing well inside a 12-hour notice period. Archiving at 60 days would put still-active records into an offline tier where every occasional read incurs a rehydration delay and early-deletion charges.

Question 3 · Deploy and manage Azure compute resources

Sablefield Robotics runs a stateless API on 6 identical virtual machines behind a standard load balancer and needs an in-place operating system patch applied to no more than 2 machines at a time, with automatic rollback if health probes fail. Which service should you use?

  1. A.Azure Update Manager with a maintenance configuration scheduled weekly
  2. B.An availability set with three fault domains and manual patching
  3. C.A Virtual Machine Scale Set with automatic OS image upgrades and a rolling upgrade policy
  4. D.Azure Automation State Configuration with a pull server per machine
Show answer & explanation

Answer: C

A scale set with a rolling upgrade policy updates instances in batches whose size you cap, checks the application health extension or load balancer probe between batches, and halts the rollout when instances become unhealthy. Update Manager schedules guest patching but does not orchestrate batch sizes with automatic halt-on-unhealthy behaviour for image upgrades.

Question 4 · Implement and manage virtual networking

The web tier of Farrow Instruments lives in snet-web (10.20.1.0/24) and the database tier in snet-data (10.20.2.0/24) of the same virtual network. Database servers must accept 1433 only from snet-web, and all other inbound traffic to snet-data must be dropped. Which rule set on the NSG attached to snet-data works?

  1. A.An allow rule for source 10.20.1.0/24 to destination port 1433 at priority 100, and a deny rule for source VirtualNetwork to any port at priority 200
  2. B.An allow rule for source VirtualNetwork to port 1433 at priority 100 and a service endpoint on snet-data
  3. C.A deny rule for source Any at priority 100 and an allow rule for 10.20.1.0/24 to port 1433 at priority 200
  4. D.A single allow rule for source 10.20.1.0/24 to port 1433 at priority 100, relying on the default rules to block the rest
Show answer & explanation

Answer: A

The default rule AllowVNetInBound permits all traffic between subnets in the same virtual network, so a custom deny for the VirtualNetwork source at a lower-priority number than that default is needed after the specific allow. Relying on defaults alone leaves intra-VNet traffic on every other port permitted, and placing the deny at priority 100 would block the SQL rule that follows it.

Question 5 · Monitor and maintain Azure resources

Operations at Windermere Freight need a single Log Analytics query to show CPU trends across 30 virtual machines. Guest performance counters are not appearing in the workspace even though the machines are running. What is the most likely gap?

  1. A.Diagnostic settings on each VM resource must be enabled to forward guest metrics
  2. B.The workspace retention is set below 30 days, so counters are discarded on ingestion
  3. C.The VMs must be moved into the same resource group as the Log Analytics workspace
  4. D.The VMs lack the Azure Monitor Agent with a data collection rule that gathers performance counters into the workspace
Show answer & explanation

Answer: D

Guest-level metrics such as processor counters come from the Azure Monitor Agent, which only collects what an associated data collection rule specifies and sends it to the target workspace. Resource diagnostic settings emit platform metrics and logs from the VM resource itself and never reach inside the operating system.

Question 6 · Manage Azure identities and governance

You are the Global Administrator for the Entra ID tenant of Marisol Diagnostics. A contractor named Dev Okafor needs to reset passwords for users in the Lab department and manage those users' group memberships, but must have no rights over any other department. What should you configure?

  1. A.Assign the User Administrator role at the tenant level and add a conditional access policy limiting Dev to the Lab network
  2. B.Assign the Helpdesk Administrator role scoped to an administrative unit that contains the Lab users
  3. C.Create a custom RBAC role in the Lab resource group granting Microsoft.Authorization/* permissions
  4. D.Add Dev as an owner of each Lab security group and grant the Directory Readers role
Show answer & explanation

Answer: B

Administrative units restrict the reach of a directory role to a defined set of users or groups, so Helpdesk Administrator assigned over a Lab administrative unit grants password reset only for those members. Conditional access controls the conditions of sign-in, not the set of objects an admin role can act upon, so a tenant-level assignment would still expose every department.

Question 7 · Implement and manage storage

A partner application must upload files to a single container named intake-2027 in the account stbramwell for the next 7 days, and you must be able to revoke that access instantly without rotating the account keys. Which option should you choose?

  1. A.An account SAS signed with key1 and a 7-day expiry
  2. B.A service SAS tied to a stored access policy on the container
  3. C.A user delegation SAS with a 7-day expiry signed by your own credentials
  4. D.A shared access signature generated from key2 with the container set to public read access
Show answer & explanation

Answer: B

A stored access policy defines the permissions and expiry server side, so deleting or altering the policy immediately invalidates every SAS that references it without touching the account keys. An account SAS carries its terms inside the token itself, so the only way to revoke it early is to rotate the signing key.

Question 8 · Deploy and manage Azure compute resources

A finance application at Rowntree Legal runs on a single VM that must survive a datacenter-level power failure within its region, and the workload cannot be re-architected for multiple instances. Which deployment choice provides the strongest availability commitment?

  1. A.Deploy the VM into an availability set with two fault domains
  2. B.Deploy the VM into a proximity placement group in the same region
  3. C.Deploy the VM with Azure Site Recovery replication to a paired region
  4. D.Deploy the VM into an availability zone with premium SSD or ultra disk
Show answer & explanation

Answer: D

A single VM pinned to an availability zone with premium SSD or ultra disk carries the highest single-instance SLA because zones are physically separate datacenters with independent power and cooling. An availability set protects only against rack-level failures inside one datacenter, so a full facility power loss can still take the VM down.

292+ more questions, free

Full-length, timed or practice mode, weighted to the official blueprint — with per-domain scoring so you know exactly where you stand.

Start the full practice exam →

All questions are original — never reproduced from the real exam — and pass automated duplicate, citation and item-writing checks before publication. See how our exams are made.

Kwizza is an independent study tool and is not affiliated with, endorsed by, or sponsored by Microsoft. Microsoft names, logos and certification marks are the property of their respective owners and are used here only to identify the exam described. Practice questions are original, written against the publicly published exam objectives — no real exam content is reproduced.