AZ-104 Practice Test 1 – 50 Questions and Answers (Azure Administrator, 2025 Updated)

AZ-104 Practice Test 1: 50 Questions and Answers for Azure Administrator

Published April 4, 2025

Practice AZ-104 questions covering Azure identities and governance, storage, compute, virtual networking, monitoring, and maintenance. Select your answers, review the explanations, and track your progress in the Learning Dashboard.

Exam: AZ-104Questions: 50Recommended score: 70%+Time: 90 minutes

Before you start

This practice test includes single-choice, multiple-response, and true/false questions. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AZ-104 practice test questions

Question 1: What is the primary function of Microsoft Entra ID in Azure?

• User authentication
• Resource scaling
• Data encryption
• Network configuration

The correct answer is User authentication.

Microsoft Entra ID verifies user identities and manages access to resources. It provides a centralized identity management service with features like single sign‑on and multi‑factor authentication. This ensures that only authorized users can access your applications and data.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 2: Which action is used to create new users in Microsoft Entra ID?

• Manage user groups
• Create users
• Assign roles
• Configure policies

The correct answer is Create users.

This option allows administrators to add new user accounts to the directory. It is a fundamental part of setting up identity management in Azure. Proper creation of users is essential for managing access and ensuring security.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 3: How can you manage licenses in Microsoft Entra ID?

• By assigning license SKUs to users
• By configuring storage accounts
• By creating virtual machines
• By setting up network rules

The correct answer is By assigning license SKUs to users.

Licensing in Microsoft Entra ID involves assigning the appropriate license to each user account. This process ensures that users have access to the necessary Microsoft services. It also helps maintain compliance and control over resource usage.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 4: What does configuring self‑service password reset (SSPR) enable for users?

• It allows users to reset passwords without admin assistance
• It increases billing costs
• It restricts user access
• It automates resource deployment

The correct answer is It allows users to reset passwords without admin assistance.

SSPR empowers users to manage their own password resets securely. This reduces the dependency on IT support and minimizes downtime. It also enhances user satisfaction by providing immediate resolution to password issues.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 5: Which built‑in Azure role provides full access to all resources?

• Owner
• Contributor
• Reader
• User Access Administrator

The correct answer is Owner.

The Owner role grants full control over all resources within a subscription. It includes the ability to delegate access to others. This role is critical for administrators who require complete management capabilities.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 6: What is the purpose of resource locks in Azure governance?

• Prevent accidental deletion or modification
• Monitor resource performance
• Improve network speed
• Assign user roles

The correct answer is Prevent accidental deletion or modification.

Resource locks are applied to protect critical resources from unintended changes. They serve as an additional safety measure to preserve important configurations. This helps ensure the stability and reliability of your environment.

Related Microsoft Learn topic

Lock resources to prevent changes

Question 7: Which of the following tasks are part of managing Microsoft Entra users and groups? Choose 2 answers.

• Create users
• Manage user and group properties
• Deploy virtual machines
• Configure storage accounts
• Manage licenses

The correct answers are Create users and Manage user and group properties.

These tasks are central to establishing and maintaining the directory. They ensure that user information is accurate and up-to-date. This, in turn, supports effective access control and security management.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 8: Which of the following are responsibilities when managing access to Azure resources? Choose 2 answers.

• Assign roles at different scopes
• Interpret access assignments
• Configure storage redundancy
• Manage backup policies
• Monitor network traffic

The correct answers are Assign roles at different scopes and Interpret access assignments.

These responsibilities involve both setting and understanding the permissions across resources. They are critical for ensuring that each user has the appropriate level of access. This helps maintain a secure and compliant environment.

Related Microsoft Learn topic

Azure Backup overview

Question 9: Which components are involved in managing Azure subscriptions and governance? Choose 2 answers.

• Configure resource locks
• Apply and manage tags on resources
• Set up Azure Backup vault
• Manage resource groups
• Deploy ARM templates

The correct answers are Apply and manage tags on resources and Manage resource groups.

These components assist in organizing and categorizing resources effectively. Tags help in cost tracking and reporting while resource groups provide logical grouping. This organization is crucial for efficient governance and management.

Related Microsoft Learn topic

Lock resources to prevent changes

Question 10: Microsoft Entra ID is used for managing user identities in Azure.

• True
• False

The correct answer is True.

Microsoft Entra ID is the central identity service for Azure, handling authentication and access management. It supports features like single sign‑on and multi‑factor authentication. This ensures that only authorized users can access resources.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 11: Self‑service password reset (SSPR) requires no initial configuration.

• True
• False

The correct answer is False.

SSPR must be configured by an administrator before users can utilize it. It involves setting up policies and verification methods to ensure secure password resets. Proper configuration is necessary to prevent unauthorized access.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 12: Built‑in Azure roles cannot be modified by users.

• True
• False

The correct answer is True.

Built‑in roles are predefined by Microsoft and cannot be altered by customers. They provide a consistent set of permissions for managing resources. This standardization helps maintain security and simplifies role management.

Related Microsoft Learn topic

Microsoft Entra ID documentation

Question 13: Which feature secures access to an Azure Storage account?

• Storage firewalls and virtual networks
• Virtual machine scaling
• User authentication
• Azure Policy assignments

The correct answer is Storage firewalls and virtual networks.

This feature restricts access based on network rules and IP addresses. It provides an additional layer of security for your storage account. Ensuring proper configuration is critical to protect data from unauthorized access.

Related Microsoft Learn topic

Azure Storage account overview

Question 14: What is the purpose of a Shared Access Signature (SAS) token?

• Grant limited access to storage resources
• Provide full administrative rights
• Encrypt data at rest
• Monitor storage performance

The correct answer is Grant limited access to storage resources.

A SAS token allows temporary and restricted access to a storage account. It limits permissions and the duration of access. This helps securely share data without exposing the entire account.

Related Microsoft Learn topic

Grant limited access to Azure Storage resources using SAS

Question 15: How can you configure redundancy for an Azure Storage account?

• By selecting the appropriate replication option
• By increasing the number of virtual machines
• By enabling self‑service password reset
• By configuring resource locks

The correct answer is By selecting the appropriate replication option.

Azure Storage offers various replication options to ensure data durability. These options provide different levels of redundancy and availability. Choosing the right replication strategy is essential for disaster recovery.

Related Microsoft Learn topic

Lock resources to prevent changes

Question 16: What does configuring object replication in Azure Storage achieve?

• It copies data between storage accounts
• It increases network throughput
• It automates user provisioning
• It manages storage account encryption

The correct answer is It copies data between storage accounts.

Object replication synchronizes data across different regions. It enhances data availability and disaster recovery capabilities. This ensures that your data remains accessible even if one region experiences issues.

Related Microsoft Learn topic

Grant limited access to Azure Storage resources using SAS

Question 17: Which of the following tasks are involved in managing access to Azure Storage? Choose 2 answers.

• Configure stored access policies
• Manage access keys
• Deploy virtual machines
• Configure identity‑based access for Azure Files
• Set up Azure Policy

The correct answers are Configure stored access policies and Manage access keys.

These tasks are crucial for controlling who can access storage resources. They ensure that access permissions are enforced properly. This management protects sensitive data from unauthorized use.

Related Microsoft Learn topic

Azure Storage account overview

Question 18: Which actions can be performed on a storage account? Choose 2 answers.

• Create and configure storage accounts
• Configure storage account encryption
• Deploy containerized applications
• Configure virtual network peering
• Manage user identities

The correct answers are Create and configure storage accounts and Configure storage account encryption.

These actions establish and secure the storage environment. They are fundamental for ensuring data is stored safely. Proper configuration leads to improved performance and compliance.

Related Microsoft Learn topic

Azure Storage account overview

Question 19: Which features enhance data protection in Azure Storage? Choose 2 answers.

• Configure soft delete for blobs and containers
• Configure blob lifecycle management
• Manage virtual machine disks
• Configure snapshots for Azure Files
• Assign built‑in roles for governance

The correct answers are Configure soft delete for blobs and containers and Configure snapshots for Azure Files.

These features provide recovery options if data is accidentally deleted. They add an extra layer of protection for your data. This ensures that critical information can be restored when needed.

Related Microsoft Learn topic

Azure Storage account overview

Question 20: Shared Access Signatures (SAS) provide time‑limited access to storage resources.

• True
• False

The correct answer is True.

SAS tokens allow controlled, temporary access to storage accounts. They limit permissions and the duration for which access is granted. This minimizes the risk of unauthorized data exposure.

Related Microsoft Learn topic

Grant limited access to Azure Storage resources using SAS

Question 21: Configuring stored access policies is not recommended for managing access to storage accounts.

• True
• False

The correct answer is False.

Configuring stored access policies is a best practice for managing storage access. It allows centralized control and easy revocation of SAS tokens. This enhances overall data security and manageability.

Related Microsoft Learn topic

Grant limited access to Azure Storage resources using SAS

Question 22: What is the primary purpose of an ARM template in Azure?

• Automate the deployment of resources
• Manage network traffic
• Monitor resource performance
• Configure user roles

The correct answer is Automate the deployment of resources.

ARM templates allow you to define infrastructure as code. They ensure consistent and repeatable deployments across environments. This approach minimizes manual errors and speeds up provisioning.

Related Microsoft Learn topic

ARM templates overview

Question 23: Which Azure service is used to deploy virtual machines?

• Azure Virtual Machines
• Azure Blob Storage
• Azure DNS
• Azure Resource Manager
• Azure Policy

The correct answer is Azure Virtual Machines.

This service is designed to provision and manage VMs in the cloud. It supports a wide range of operating systems and configurations. It provides the flexibility required for various workload types.

Related Microsoft Learn topic

Azure Virtual Machines overview

Question 24: How does Azure Disk Encryption secure a virtual machine?

• By encrypting the operating system and data disks
• By using built‑in antivirus
• By isolating the VM in a private network
• By assigning special roles

The correct answer is By encrypting the operating system and data disks.

Azure Disk Encryption uses industry‑standard encryption algorithms. It protects sensitive information stored on VMs from unauthorized access. This ensures that even if data is compromised, it remains unreadable.

Related Microsoft Learn topic

Azure Virtual Machines overview

Question 25: What is the function of an Azure Virtual Machine Scale Set?

• Automatically scale and manage a set of VMs
• Provide storage redundancy
• Manage network security
• Monitor cost consumption
• Deploy containerized applications

The correct answer is Automatically scale and manage a set of VMs.

Virtual Machine Scale Sets automatically adjust the number of VMs based on demand. They help maintain performance during periods of high load. This also simplifies management by treating the set as a single resource.

Related Microsoft Learn topic

Virtual Machine Scale Sets overview

Question 26: Which Azure service is designed for serverless container hosting?

• Azure Container Instances
• Azure Virtual Machines
• Azure App Service
• Azure Functions

The correct answer is Azure Container Instances.

This service enables running containers without managing the underlying infrastructure. It offers rapid deployment and scaling. It simplifies container management and reduces operational overhead.

Related Microsoft Learn topic

Azure Virtual Machines overview

Question 27: What does exporting a deployment as an ARM template allow you to do?

• Reuse and version control your deployment
• Increase resource performance
• Automatically scale virtual machines
• Deploy resources in multiple regions

The correct answer is Reuse and version control your deployment.

Exporting an ARM template captures the current configuration of your resources. It enables you to redeploy the same setup across different environments. This supports best practices for infrastructure as code and consistency.

Related Microsoft Learn topic

ARM templates overview

Question 28: Which of the following tasks are involved in managing virtual machines in Azure? Choose 2 answers.

• Creating virtual machines
• Configuring Azure Disk Encryption
• Deploying Azure Container Apps
• Managing virtual machine sizes
• Assigning user licenses

The correct answers are Creating virtual machines and Managing virtual machine sizes.

These tasks ensure that VMs are properly provisioned and optimized for performance. They are critical for resource efficiency and cost management. Proper management of VMs leads to stable and scalable compute environments.

Related Microsoft Learn topic

Azure Virtual Machines overview

Question 29: Which of the following can be done using ARM templates or Bicep files? Choose 2 answers.

• Automate deployment of resources
• Modify existing deployments
• Monitor virtual networks
• Export deployments for reuse
• Configure storage redundancy

The correct answers are Automate deployment of resources and Export deployments for reuse.

ARM templates and Bicep files allow you to define infrastructure as code. They support consistent deployments and version control. This leads to more reliable and repeatable provisioning processes.

Related Microsoft Learn topic

ARM templates overview

Question 30: Which services are used for container management in Azure? Choose 2 answers.

• Azure Container Instances
• Azure Container Apps
• Azure Virtual Machines
• Azure App Service
• Azure Backup

The correct answers are Azure Container Instances and Azure Container Apps.

Both services are specifically designed for running containerized workloads. They provide different deployment and scaling options for containers. This flexibility supports various container management scenarios.

Related Microsoft Learn topic

Azure Backup overview

Question 31: Azure Resource Manager templates allow for declarative deployment of resources.

• True
• False

The correct answer is True.

ARM templates define the desired state of your infrastructure in a declarative format. They enable automated, consistent, and repeatable deployments. This minimizes errors and reduces manual intervention during provisioning.

Related Microsoft Learn topic

ARM templates overview

Question 32: Virtual Machine Scale Sets are used to manually scale VMs without automation.

• True
• False

The correct answer is False.

Virtual Machine Scale Sets are designed for automated scaling based on demand. They automatically adjust the number of VMs to meet workload requirements. This ensures optimal performance and efficient resource utilization.

Related Microsoft Learn topic

Virtual Machine Scale Sets overview

Question 33: Azure Container Instances provide a serverless option for running containers.

• True
• False

The correct answer is True.

Azure Container Instances allow containers to run without the need for managing underlying servers. They offer quick deployment and automatic scaling features. This simplifies the process of running containerized applications in the cloud.

Related Microsoft Learn topic

Azure Virtual Machines overview

Question 34: What is the primary purpose of a virtual network in Azure?

• Isolate and secure resources
• Manage user licenses
• Deploy ARM templates
• Monitor resource performance

The correct answer is Isolate and secure resources.

Virtual networks create a dedicated space for your Azure resources. They allow segmentation and secure communication between resources. This isolation is crucial for protecting sensitive data and applications.

Related Microsoft Learn topic

ARM templates overview

Question 35: Which feature allows you to create a private connection to an Azure PaaS service?

• Private Endpoint
• Public IP Address
• Load Balancer
• Virtual Machine Scale Set

The correct answer is Private Endpoint.

This feature enables a secure, private connection to Azure PaaS services. It prevents exposure of data to the public internet. This improves security and compliance for accessing cloud services.

Related Microsoft Learn topic

Virtual Machine Scale Sets overview

Question 36: What is the function of an NSG (Network Security Group)?

• Control inbound and outbound traffic
• Deploy virtual machines
• Encrypt data at rest
• Configure user roles

The correct answer is Control inbound and outbound traffic.

NSGs allow you to create rules that filter network traffic. They help protect your virtual networks from unauthorized access. This contributes significantly to the overall security of your infrastructure.

Related Microsoft Learn topic

Azure Virtual Network overview

Question 37: Which tool would you use to diagnose network connectivity issues in Azure?

• Azure Network Watcher
• Azure Policy
• Azure Cost Management
• Azure Advisor

The correct answer is Azure Network Watcher.

This tool provides monitoring and diagnostic capabilities for network issues. It helps capture and analyze network traffic for troubleshooting. Using it ensures that connectivity problems are quickly identified and resolved.

Related Microsoft Learn topic

Azure Network Watcher overview

Question 38: Which of the following tasks are involved in managing virtual networks? Choose 2 answers.

• Creating virtual networks and subnets
• Configuring public IP addresses
• Deploying ARM templates
• Setting up virtual network peering
• Managing user identities

The correct answers are Creating virtual networks and subnets and Setting up virtual network peering.

These tasks are essential for establishing and connecting virtual networks. They ensure that resources can communicate securely within and across networks. This configuration is key to a robust network infrastructure.

Related Microsoft Learn topic

ARM templates overview

Question 39: Which features help secure virtual networks in Azure? Choose 2 answers.

• Network Security Groups
• Application Security Groups
• Virtual Machine Scale Sets
• User‑defined routes
• Resource locks

The correct answers are Network Security Groups and Application Security Groups.

These features allow you to define and enforce security rules at different levels. They offer granular control over inbound and outbound traffic. This enhances the overall security of your virtual networks.

Related Microsoft Learn topic

Lock resources to prevent changes

Question 40: Which options are used for load balancing in Azure virtual networking? Choose 2 answers.

• Internal Load Balancer
• Public Load Balancer
• Azure DNS
• Azure Backup
• Private Endpoint

The correct answers are Internal Load Balancer and Public Load Balancer.

These services distribute incoming traffic across multiple resources. They help maintain high availability and optimal performance. This setup is essential for efficient resource utilization under varying loads.

Related Microsoft Learn topic

Azure Private Link and private endpoints

Question 41: Virtual network peering allows resources in different virtual networks to communicate as if they were in the same network.

• True
• False

The correct answer is True.

Virtual network peering connects separate networks seamlessly. It enables direct traffic flow between resources in different virtual networks. This integration simplifies management and enhances performance.

Related Microsoft Learn topic

Azure Virtual Network overview

Question 42: Azure Bastion provides secure and seamless RDP/SSH connectivity to virtual machines without exposing public IPs.

• True
• False

The correct answer is True.

Azure Bastion offers secure remote connectivity through the Azure Portal. It eliminates the need to expose virtual machines with public IP addresses. This improves security by reducing the attack surface.

Related Microsoft Learn topic

Azure Virtual Network overview

Question 43: What is the primary function of Azure Monitor?

• Collect and analyze metrics and logs
• Deploy virtual machines
• Assign user roles
• Manage storage accounts

The correct answer is Collect and analyze metrics and logs.

Azure Monitor gathers data from various resources to provide insights into performance. It enables early detection of issues through real‑time monitoring. This service is crucial for maintaining the overall health of your environment.

Related Microsoft Learn topic

Azure Monitor overview

Question 44: Which service in Azure is used to configure and manage alert rules?

• Azure Monitor
• Azure Resource Manager
• Azure Advisor
• Azure Policy

The correct answer is Azure Monitor.

It allows you to set up alert rules based on collected metrics and logs. Alerts help notify you of potential issues before they escalate. This proactive approach ensures timely intervention and system stability.

Related Microsoft Learn topic

Azure Monitor overview

Question 45: What is the role of Azure Backup in resource maintenance?

• Protect data by creating recoverable backups
• Monitor network traffic
• Manage user access
• Deploy virtual networks

The correct answer is Protect data by creating recoverable backups.

Azure Backup safeguards your data by allowing regular backups. It enables recovery in case of accidental data loss or corruption. This ensures continuity and reliability of business operations.

Related Microsoft Learn topic

Azure Backup overview

Question 46: Which of the following tasks are part of monitoring Azure resources? Choose 2 answers.

• Interpreting metrics in Azure Monitor
• Querying and analyzing logs
• Configuring resource locks
• Managing user groups
• Deploying ARM templates

The correct answers are Interpreting metrics in Azure Monitor and Querying and analyzing logs.

These activities are essential for understanding resource performance. They help in early detection of anomalies and potential issues. This monitoring is vital for proactive maintenance and optimization.

Related Microsoft Learn topic

Lock resources to prevent changes

Question 47: Which actions can be performed using Azure Network Watcher? Choose 2 answers.

• Monitor network connectivity
• Capture network traffic
• Configure virtual networks
• Deploy backup policies
• Manage user licenses

The correct answers are Monitor network connectivity and Capture network traffic.

Azure Network Watcher provides diagnostic tools for network issues. It enables you to capture packets and analyze network flows. This is essential for troubleshooting and maintaining network health.

Related Microsoft Learn topic

Azure Network Watcher overview

Question 48: Azure Monitor Insights provides detailed monitoring for virtual machines, storage accounts, and networks.

• True
• False

The correct answer is True.

Azure Monitor Insights aggregates data from various resources to deliver in-depth analysis. It helps in identifying performance bottlenecks and optimizing operations. This detailed monitoring is essential for maintaining a healthy infrastructure.

Related Microsoft Learn topic

Azure Monitor overview

Question 49: Azure Backup can be used to perform failover to a secondary region.

• True
• False

The correct answer is False.

Azure Backup is used to back up and restore protected data and workloads. Cross-region restore can help restore supported workloads in a secondary region, but failover orchestration is handled by Azure Site Recovery. For disaster recovery scenarios that require planned or unplanned failover, Azure Site Recovery is the better match.

Related Microsoft Learn topic

Grant limited access to Azure Storage resources using SAS

Question 50: Azure Site Recovery is used only for on‑premises disaster recovery and not for Azure resources.

• True
• False

The correct answer is False.

Azure Site Recovery supports disaster recovery for both on‑premises and Azure resources. It enables seamless failover to a secondary site in case of disruptions. This versatility makes it an essential tool for comprehensive business continuity planning.

Related Microsoft Learn topic

Grant limited access to Azure Storage resources using SAS

References

Use these Microsoft Learn resources to review the concepts covered in this AZ-104 practice test.

• Microsoft Entra ID documentation
• Lock resources to prevent changes
• Azure Backup overview
• Azure Storage account overview
• Grant limited access to Azure Storage resources using SAS
• ARM templates overview
• Azure Virtual Machines overview
• Virtual Machine Scale Sets overview
• Azure Virtual Network overview
• Azure Network Watcher overview
• Azure Private Link and private endpoints
• Azure Monitor overview
• AZ-104 study guide
• Azure Site Recovery overview