CertCrack

Microsoft Azure Administrator · AZ-104

AZ-104 Practice Exam: 730 Questions with Explanations

Preparing for the Microsoft Azure Administrator (AZ-104) certification? CertCrack gives you 730 original practice questions mapped to the official AZ-104 skills outline — identities and governance, storage, compute, virtual networking, and monitoring. Every question includes a detailed explanation so you learn the why, not just the answer.

What's inside

Try 30 sample questions

These are real samples from the AZ-104 bank — the full version has 730 like these.

1. Your company hires 200 interns. You need to create a Microsoft Entra user account for each intern as quickly as possible. What should you use?

  1. Create each user manually in the Microsoft Entra admin center
  2. A dynamic group with a membership rule
  3. A bulk create operation with a CSV file in the Microsoft Entra admin center
  4. Assign Microsoft 365 licenses to a security group
Correct answer: C. Correct: Bulk create lets you create many users at once by uploading a CSV file with the required properties such as UPN and display name. Why others are wrong: A) Creating 200 users one by one is slow and error-prone; bulk create exists for exactly this scenario. B) Dynamic groups manage group membership automatically but do not create user accounts. D) Assigning licenses requires the user accounts to already exist.

2. You need to assign a license to User1 using Microsoft Graph PowerShell. Which cmdlet should you use?

  1. Set-MgUserLicense
  2. New-MgUser
  3. Set-MgUser with a license switch
  4. New-MgGroup for license assignment
Correct answer: A. Correct: Set-MgUserLicense assigns or removes licenses on a user. Why others are wrong: B) New-MgUser creates users; it does not handle licensing. C) There is no license switch on Set-MgUser. D) New-MgGroup creates groups and has no license assignment function.

3. User1 has the Reader role on a storage account and tries to regenerate the access keys. What happens?

  1. The keys regenerate because Reader includes key operations
  2. User1 is prompted for MFA and then the operation succeeds
  3. The operation is denied; Reader grants read-only management-plane access
  4. The keys regenerate but the old keys keep working indefinitely
Correct answer: C. Correct: Reader is read-only on the management plane; regenerating keys is a write operation. Why others are wrong: A) Key operations are writes, excluded from Reader. B) MFA does not grant missing permissions. D) This describes no real behavior.

4. Contoso's cloud team wants to prevent any virtual machine larger than Standard_D4s_v3 from being deployed in the Production resource group, but in the Development resource group they only want to flag oversized VMs without blocking them. What should you do?

  1. Assign a policy with the Deny effect at the Production scope and a policy with the Audit effect at the Development scope
  2. Assign a policy with the Deny effect at the subscription scope
  3. Apply a ReadOnly resource lock on the Production resource group
  4. Create a custom RBAC role that denies virtual machine SKUs larger than Standard_D4s_v3
Correct answer: A. Correct: Azure Policy evaluates resource properties, so a Deny policy at the Production scope blocks oversized VMs only there, while an Audit policy at the Development scope only flags them. Why others are wrong: B) A subscription-level Deny would block oversized VMs in Development too. C) A ReadOnly lock blocks all changes in the resource group, not just VM sizes. D) RBAC is an allow-model for who can act; it cannot evaluate resource properties like VM SKU.

5. During a change freeze, you must prevent deletion of every resource in the Production resource group while still allowing configuration changes. What is the most efficient approach?

  1. Apply a ReadOnly lock on the resource group
  2. Apply a CanNotDelete lock on each resource individually
  3. Apply a single CanNotDelete lock on the resource group
  4. Assign an Azure Policy with the Deny effect on delete operations
Correct answer: C. Correct: One CanNotDelete lock at the resource group scope is inherited by all resources, blocking deletes while allowing modifications. Why others are wrong: A) ReadOnly would also block the allowed configuration changes. B) Individual locks work but are inefficient to manage. D) Policy does not have a delete-operation effect; locks are the correct tool.

6. A test subscription is no longer needed and you want to stop all charges immediately. What should you do?

  1. Stop all virtual machines
  2. Delete all resources, then cancel the subscription
  3. Delete the resource groups but keep the subscription
  4. Remove all users from the subscription
Correct answer: B. Correct: Deleting resources stops metered usage, and canceling the subscription ends the billing relationship. Why others are wrong: A) Stopped VMs still incur disk and other charges. C) Keeping the subscription with no resources still risks future charges. D) User access does not affect billing.

7. A storage account hosts blob data for an internal application. The application runs on virtual machines in VNet1. Developers also need access from the corporate office public IP address 203.0.113.10. All other public access must be blocked. What should you configure on the storage account?

  1. Set the default network action to Allow and add a virtual network rule for VNet1
  2. Set the default network action to Deny, then add a virtual network rule for VNet1 and an IP rule for 203.0.113.10
  3. Create a private endpoint in VNet1 and disable public network access
  4. Set the default network action to Deny and add only an IP rule for 203.0.113.10
Correct answer: B. Correct: Deny-by-default with explicit allow rules follows least privilege — only VNet1 and the office IP can reach the storage account. Why others are wrong: A) Allow as the default leaves the storage account open to the entire internet; C) A private endpoint would also block the corporate office IP, which must remain reachable; D) The IP rule alone does not cover the VMs in VNet1.

8. An application must remain available if an entire datacenter in the primary region fails, but it does not need a secondary region. Which redundancy option meets this requirement?

  1. LRS
  2. GRS
  3. RA-GRS
  4. ZRS
Correct answer: D. Correct: ZRS synchronously replicates three copies across availability zones in the primary region, surviving a datacenter-level failure. Why others are wrong: A) LRS keeps all copies in one datacenter; B) GRS protects against regional loss but its primary copies are still in one datacenter; C) RA-GRS adds secondary read access but its primary is still LRS-based in one datacenter.

9. A user accidentally deletes an important spreadsheet from an Azure file share. A share snapshot was taken yesterday. What is the fastest way to recover the file?

  1. Undelete the blob
  2. Create a lifecycle management rule
  3. Restore the file from the share snapshot
  4. Fail over the storage account
Correct answer: C. Correct: Individual files can be restored from a share snapshot without restoring the whole share. Why others are wrong: A) Blob undelete applies to soft-deleted blobs, not files in a share; B) Lifecycle management tiers or deletes blobs, it does not restore files; D) Failover is for regional outages, not file recovery.

10. A storage account uses a customer-managed key, but the Key Vault has its firewall enabled and encryption operations are failing. What should you configure?

  1. Disable the Key Vault firewall
  2. Allow trusted services to bypass the Key Vault firewall so the storage resource provider can reach the key
  3. Make the Key Vault publicly accessible
  4. Issue a SAS token for the Key Vault
Correct answer: B. Correct: The Key Vault firewall would block the storage resource provider, so you allow trusted services (or use managed identity bypass) so the platform can access the key. Why others are wrong: A) Disabling the firewall removes a security control unnecessarily; C) A public vault is worse; D) SAS tokens are unrelated to Key Vault access for CMK.

11. A video-processing application needs the lowest possible latency reading and writing block blobs. Which storage option should you choose?

  1. Standard general-purpose v2
  2. Cool access tier
  3. Archive access tier
  4. Premium block blobs (BlockBlobStorage)
Correct answer: D. Correct: Premium block blobs (BlockBlobStorage) provide the lowest, most consistent latency for block blob workloads. Why others are wrong: A) Standard GPv2 has higher and less consistent latency; B) The Cool tier is about cost, not latency; C) Archive is offline.

12. A lifecycle management policy must move blobs older than 365 days from the Hot tier directly to the Archive tier. Is this supported?

  1. It is not allowed — blobs must go through Cool first
  2. A lifecycle rule can tier blobs directly from Hot to Archive
  3. Only manual tiering supports Hot to Archive
  4. Only Cool blobs can be archived
Correct answer: B. Correct: Lifecycle management supports tierToArchive directly from Hot or Cool tiers. Why others are wrong: A) Direct tiering to Archive is allowed; C) There is no requirement to pass through Cool; D) Manual tiering works but the question asks about lifecycle support.

13. You deploy an ARM template in Complete mode to a resource group that also contains a manually created storage account which is NOT defined in the template. What happens to the storage account?

  1. The storage account is left untouched and the deployment succeeds
  2. The storage account is deleted because it is not defined in the template
  3. The deployment fails validation before any changes are made
  4. The storage account is automatically moved to a different resource group
Correct answer: B. Correct: Complete mode makes the resource group exactly match the template, deleting any resources not defined in it. Why others are wrong: A) describes Incremental mode, which leaves existing resources alone; C) describes a what-if/validation operation, not Complete mode; D) deployments never move resources between groups.

14. You need to create an Ubuntu 22.04 VM named vm1 in resource group RG1 with a new SSH key pair generated during creation. Which command is correct?

  1. az vm create --resource-group RG1 --name vm1 --image Ubuntu2204 --admin-username azureuser --generate-ssh-keys
  2. az vm create --resource-group RG1 --name vm1 --image Ubuntu2204 --admin-username azureuser --ssh-key ~/.ssh/id_rsa.pub
  3. az vm create --resource-group RG1 --name vm1 --image Ubuntu2204 --admin-username azureuser --admin-password P@ssw0rd
  4. az vm deploy --resource-group RG1 --name vm1 --image Ubuntu2204 --generate-ssh-keys
Correct answer: A. Correct: --generate-ssh-keys creates a new key pair and configures the VM to use it. Why others are wrong: B) --ssh-key expects an EXISTING public key file — it does not generate one; C) sets password auth instead of generating SSH keys; D) az vm deploy is not a valid command.

15. You place four VMs in an availability set configured with 3 fault domains and 5 update domains. During planned Azure platform maintenance, what happens?

  1. All four VMs reboot at the same time
  2. One entire fault domain reboots at once
  3. VMs reboot one update domain at a time, so VMs in the other update domains keep running
  4. Planned maintenance never reboots VMs in an availability set
Correct answer: C. Correct: update domains define the maintenance blast radius — Azure updates one UD at a time, keeping the rest online. Why others are wrong: A) that would defeat the purpose of update domains; B) fault domains protect against unplanned hardware failure, not maintenance sequencing; D) maintenance can require reboots; UDs only stagger them.

16. Your company runs an e-commerce platform deployed as containers in West Europe and Southeast Asia. Developers complain that image pulls are slow in Southeast Asia because every pull crosses continents. You need a single registry that keeps images close to both deployment regions. Which Azure Container Registry SKU should you choose?

  1. Premium
  2. Standard
  3. Basic
  4. Create two Basic registries, one per region
Correct answer: A. Correct: Premium is the only SKU that supports geo-replication, which replicates images to multiple Azure regions so pulls stay local. Why others are wrong: B) Standard offers higher throughput and storage than Basic but has no geo-replication. C) Basic is for development and test with only 10 GB of storage. D) Two separate registries work but double the management overhead with no automatic replication; geo-replication is the designed solution.

17. A marketing site experiences 3x traffic spikes during campaigns. The team wants the platform to add instances automatically when CPU exceeds 70 percent and remove them when traffic subsides. Which scaling approach should they use?

  1. Scale out with autoscale rules
  2. Scale up to a larger instance size
  3. Move the app to the Free tier
  4. Add a deployment slot
Correct answer: A. Correct: Scaling out adds instances, and autoscale rules automate it based on metrics such as CPU. Why others are wrong: B) Scaling up changes the size of each instance; it does not elastically change instance count. C) The Free tier cannot scale at all. D) Deployment slots are for staging versions, not for capacity.

18. You need a free TLS certificate for www.contoso.com on a Standard plan web app. Which option should you choose?

  1. App Service Managed Certificate
  2. App Service Certificate (paid)
  3. A self-signed certificate upload
  4. A manually renewed Let's Encrypt certificate
Correct answer: A. Correct: App Service Managed Certificates are free on Standard and higher, auto-renewed, and cover subdomains. Why others are wrong: B) The paid App Service Certificate is unnecessary for a simple subdomain scenario. C) Self-signed certificates trigger browser warnings. D) Manual Let's Encrypt renewal is operational overhead the managed certificate eliminates.

19. You are designing a virtual network that must host 400 virtual machines across several subnets. Azure reserves 5 IP addresses in every subnet. What is the smallest virtual network address space that can accommodate 400 hosts?

  1. 10.0.0.0/24
  2. 10.0.0.0/25
  3. 10.0.0.0/23
  4. 10.0.0.0/22
Correct answer: C. Correct: A /23 provides 512 addresses, which covers 400 hosts plus Azure's 5 reserved addresses per subnet (C). Why others are wrong: A) A /24 provides only 256 addresses, far short of 400 hosts. B) A /25 provides 128 addresses, far short of 400 hosts. D) A /22 provides 1,024 addresses and would work, but it is not the smallest space that fits the requirement.

20. Two virtual networks are peered. A VM in VNet-A cannot ping a VM in VNet-B, but peering status is 'Connected' on both sides. The NSGs use only default rules. What should you check first?

  1. Whether the virtual networks have overlapping address spaces
  2. Whether a custom NSG rule or route table is blocking the traffic
  3. Whether gateway transit is enabled on the peering
  4. Whether both VMs are in the same availability zone
Correct answer: B. Correct: With Connected peering and default NSG rules, the virtual network tag allows the traffic; a custom deny rule or UDR is the likely culprit (B). Why others are wrong: A) Overlapping address spaces prevent peering creation entirely, but status is Connected here. C) Gateway transit only matters for sharing VPN/ExpressRoute gateways, not VNet-to-VNet traffic. D) Availability zones do not affect connectivity between peered VNets.

21. A VM cannot connect to an Azure SQL logical server on port 1433. You suspect a network security group is blocking the traffic. Which Network Watcher tool directly tests whether a packet with a specific source, destination, protocol, and ports would be allowed or denied, and identifies the deciding rule?

  1. Check the effective routes on the VM's network interface
  2. Run a packet capture on the virtual machine
  3. Use IP flow verify in Network Watcher with the 5-tuple for port 1433
  4. Run Connection troubleshoot from the VM blade
Correct answer: C. Correct: IP flow verify simulates a packet using the 5-tuple (protocol, source/destination IP and port) and reports whether traffic is allowed or denied and which NSG rule decided (C). Why others are wrong: A) Effective routes show routing, not security filtering. B) Packet capture records actual traffic but does not evaluate NSG rules hypothetically. D) Connection troubleshoot runs a broader set of checks; IP flow verify is the precise tool for 5-tuple NSG evaluation.

22. A VM has NSGs on both its subnet and its network interface. You want to see the single combined, evaluated rule set that actually applies to the VM. Where do you look?

  1. The subnet's NSG rules page
  2. IP flow verify
  3. The NIC's effective routes
  4. The NIC's effective security rules
Correct answer: D. Correct: The effective security rules view combines the subnet NSG and NIC NSG into a single evaluated list, showing exactly what applies to the VM (D). Why others are wrong: A) The subnet NSG view alone omits NIC-level rules. B) IP flow verify tests a hypothetical packet rather than displaying the combined rule set. C) The NIC's effective routes show routing, not security rules.

23. Administrators need to use Bastion to RDP into servers in a peered VNet and an on-premises server by entering IP addresses directly, rather than picking Azure VMs from a list. Which Bastion capability supports this?

  1. The Standard SKU with its IP-based connection feature
  2. The Basic SKU with its default VM picker
  3. A VPN gateway with RDP shortpath
  4. A private endpoint on each VM
Correct answer: A. Correct: The Standard SKU's IP-based connection feature lets you connect via Bastion to any IP address, including peered VNets and on-premises targets (A). Why others are wrong: B) Basic SKU does not support IP-based connections. C) A VPN gateway alone does not provide browser-based RDP/SSH. D) Private endpoints are for PaaS access, not VM administration.

24. You need contoso.com itself (the zone apex, with no subdomain) to resolve to your public web app. Which record type should you use in the Azure public DNS zone?

  1. CNAME
  2. A or alias A record
  3. TXT
  4. SRV
Correct answer: B. Correct: Zone apex (naked domain) cannot use CNAME; Azure DNS supports A records and alias records pointing to Azure resources (B). Why others are wrong: A) CNAME is not allowed at the apex per DNS standards. C) TXT records hold text, not address mappings. D) SRV records are for service discovery, not apex addressing.

25. An administrator needs near real-time alerting when a virtual machine's CPU exceeds 90%. Which data type should the alert rule evaluate?

  1. Metrics
  2. Activity logs
  3. Resource logs
  4. Custom logs in a Log Analytics workspace
Correct answer: A. Correct: Metrics are numeric time-series values collected automatically at frequent intervals, making them ideal for near real-time threshold alerting. Why others are wrong: B) Activity logs record control-plane management operations (create, update, delete), not performance counters. C) Resource logs are diagnostic data-plane logs with ingestion latency and are queried on a schedule, not streamed for sub-minute alerting. D) Custom logs require scheduled KQL queries and have ingestion delay, so they are slower than metric signals.

26. What does the query Heartbeat | where TimeGenerated > ago(1h) return?

  1. Heartbeat records from the last hour
  2. Machines that stopped sending heartbeats
  3. A count of heartbeats per hour
  4. Heartbeat records older than one hour
Correct answer: A. Correct: The filter keeps rows with TimeGenerated newer than one hour ago. Why others are wrong: B) Finding missing heartbeats requires an anti-join against a machine list. C) There is no summarize, so no counts. D) The greater-than operator with ago(1h) selects recent rows, not old ones.

27. How are log alert rules evaluated?

  1. Continuously in real time
  2. By the Azure Monitor Agent
  3. Only when someone queries the workspace manually
  4. On a configured schedule by running the KQL query
Correct answer: D. Correct: Log alerts run their KQL query on a configured schedule, such as every 5 or 15 minutes. Why others are wrong: A) Near real-time evaluation applies to metric alerts. C) Evaluation is automatic, not manual. B) The agent collects data; evaluation happens service-side.

28. An alert rule scoped to a resource group monitors:

  1. Only virtual machines in the resource group
  2. All resources in the subscription
  3. The resource group itself as a resource
  4. All supported resources in the resource group
Correct answer: D. Correct: A resource-group-scoped rule evaluates signals across the applicable resources in that group. Why others are wrong: A) It is not limited to VMs. C) The resource group is a container, not a monitorable resource. B) The scope is the resource group, not the subscription.

29. For a VM running SQL Server, which backup type ensures in-memory transactions are captured consistently?

  1. Crash-consistent snapshot
  2. File-consistent snapshot
  3. Application-consistent snapshot using VSS
  4. Network-consistent snapshot
Correct answer: C. Correct: Application-consistent backups use VSS writers to quiesce the application and capture in-flight transactions. Why others are wrong: A) Crash-consistent equals a power-loss state with no app quiescing. B) and D) are not Azure Backup snapshot types.

30. An application has web, application, and database tiers that must start in a specific order during disaster recovery. How should the administrator orchestrate this in Site Recovery?

  1. Fail over each VM manually in order
  2. Create a recovery plan that groups VMs with startup sequencing
  3. Use a backup policy
  4. Use availability zones
Correct answer: B. Correct: Recovery plans define machine groups, startup order, and scripts for coordinated multi-tier failover. Why others are wrong: A) Manual failover is slow and error-prone. C) Backup policies do not orchestrate failover. D) Availability zones provide high availability, not DR orchestration.

Get full access

One payment unlocks the online question bank and the full PDF.

$10 · 3 months access

Get full access Also available on Udemy

Also on Gumroad: Get the PDF — $15, yours forever · All 4 books — $45 · Free sample — $0

Download the free sample PDF (30 questions)

15-day money-back guarantee (before 25% of questions attempted). PDF downloads are non-refundable.

Exam facts: Microsoft Azure Administrator (AZ-104)

Frequently asked questions

How long do I get access?

Three months (90 days) from purchase, covering both the interactive online bank and the full PDF download. Access can be extended.

Is there a free trial?

Yes — a free 30-question sample quiz and a free sample PDF are available with no account required, so you can judge the quality before paying.

Are these questions like the real AZ-104 exam?

All 730 questions are 100% original and mapped to the official AZ-104 skills outline, written in the same style and difficulty as the real exam. They are not copied from actual Microsoft exams.

Can I study offline?

Yes. Your purchase includes the complete question bank as a downloadable PDF for offline study.

What is the refund policy?

Full access is refundable within 15 days, or before 25% of the questions have been attempted — whichever comes first. Downloaded PDFs are non-refundable.

How much does the AZ-104 exam cost?

AZ-104 costs $165 USD. Microsoft sets the price based on the country or region where the exam is proctored, so the exact price can vary.

How many questions are on the AZ-104 exam?

Microsoft does not publish an exact count. Most Microsoft certification exams contain between 40 and 60 questions, and the number can vary between exam forms. You get 100 minutes to finish.

What is the passing score for AZ-104?

700 on Microsoft's scaled score range of 1 to 1,000. Because the score is scaled, 700 does not necessarily mean 70% of the points.

How long is the AZ-104 certification valid?

One year. Microsoft role-based certifications like Azure Administrator Associate expire after one year unless you renew them — renewal is a free online assessment on Microsoft Learn.

Where can I practice for the AZ-104 exam for free?

Right here on CertCrack. Start with the free 30-question sample quiz and the free sample PDF on this page — no account needed — and read the free AZ-104 study guidebook. When you're ready for the full bank, this page gives you every practice question with detailed explanations for $10.

Get a free practice question every week

Join the list — one exam-style question with a full explanation, every week. No spam.