AZ-104 Practice Test 2 – 50 Questions and Answers (Azure Administrator, April 2025 Updated)

AZ-104 Practice Test 2: 50 Questions and Answers for Azure Administrator

Published June 2, 2025

Practice AZ-104 questions covering Microsoft Entra identities and governance, Azure Storage, compute resources, virtual networking, monitoring, and maintenance. Select your answers, review the explanations, and track your progress in the Learning Dashboard.

Exam: AZ-104Questions: 50Recommended score: 70%+Time: 90 minutes

Before you start

This practice test includes single-choice, multiple-response, and true/false questions. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AZ-104 practice test questions

Question 1: Which feature allows temporary elevation of user permissions in Microsoft Entra ID?

• Role-Based Access Control
• Privileged Identity Management
• Conditional Access
• Microsoft Entra Connect Sync

The correct answer is Privileged Identity Management.

Privileged Identity Management provides just-in-time access to Azure AD roles, enabling users to elevate their permissions only when needed. This reduces the risk of standing privileged access. It also provides auditing and approval workflows to manage elevated sessions.

Related Microsoft Learn topic

Privileged Identity Management overview

Question 2: What is the purpose of Access Reviews in Microsoft Entra ID?

• Audit external network traffic
• Review and certify user access
• Backup directory data
• Monitor subscription costs

The correct answer is Review and certify user access.

Access Reviews allow administrators to periodically review user and group memberships to ensure that only the right people have access. This helps maintain least privilege and compliance. It also supports automated reminders and reviewer assignments.

Related Microsoft Learn topic

Microsoft Entra access reviews

Question 3: Which service synchronizes on-premises Active Directory with Microsoft Entra ID?

• Microsoft Entra Connect Sync
• Microsoft Entra Domain Services
• Azure AD B2C
• Azure Monitor

The correct answer is Microsoft Entra Connect Sync.

Microsoft Entra Connect Sync is the tool that synchronizes on-premises Active Directory users, groups, and credentials to Microsoft Entra ID. It supports password hash synchronization, pass-through authentication, and federation. This ensures a unified identity across on-premises and cloud.

Related Microsoft Learn topic

Microsoft Entra Connect Sync overview

Question 4: What does Microsoft Entra ID B2B allow?

• External user collaboration
• Data backup
• Network monitoring
• VM scaling

The correct answer is External user collaboration.

Microsoft Entra ID B2B allows you to invite external partners or contractors to collaborate using their own credentials. It provides secure access to your resources without needing to provision separate accounts. This simplifies managing guest access and maintains security boundaries.

Related Microsoft Learn topic

Microsoft Entra B2B collaboration

Question 5: Which feature enforces multi-factor authentication based on conditions?

• Conditional Access
• Application Gateway
• Traffic Manager
• Azure Front Door

The correct answer is Conditional Access.

Conditional Access policies allow you to enforce multi-factor authentication (MFA) based on user, device, location, risk level, or application. This ensures stronger security only when needed. It balances user experience with risk mitigation.

Related Microsoft Learn topic

Microsoft Entra Conditional Access overview

Question 6: Which type of role should you use to give minimal permissions to manage user licenses?

• Global Administrator
• User Administrator
• Billing Administrator
• Security Reader

The correct answer is User Administrator.

The User Administrator role grants permissions to manage users and groups, including assigning licenses, without granting full global admin rights. It is scoped to identity management tasks. This helps enforce least privilege.

Related Microsoft Learn topic

Manage identities and governance in Azure

Question 7: Which tasks are part of implementing Microsoft Entra Conditional Access? Choose 2 answers.

• Define user and group assignments
• Create Azure policies
• Specify conditions and controls
• Deploy virtual networks
• Manage resource locks

The correct answers are Define user and group assignments and Specify conditions and controls.

Defining user and group assignments determines who the policy applies to. Specifying conditions and controls sets when the policy is enforced and what actions are required. Together, these tasks form the core of a Conditional Access policy.

Related Microsoft Learn topic

Microsoft Entra Conditional Access overview

Question 8: Which components are used for managing identity governance? Choose 2 answers.

• Entitlement Management
• Azure Monitor
• Access Reviews
• Azure Policy
• Resource Graph

The correct answers are Entitlement Management and Access Reviews.

Entitlement Management automates lifecycle management of identities, groups, and access packages. Access Reviews allow periodic certification of user access. Both components help maintain compliance and governance.

Related Microsoft Learn topic

Microsoft Entra access reviews

Question 9: Which settings are configured in Microsoft Entra ID Protection? Choose 2 answers.

• Risk policies
• Storage replication
• User risk detection
• Subnet configuration
• Sign-in risk levels

The correct answers are Risk policies and Sign-in risk levels.

Risk policies define how to respond to detected risks such as requiring MFA or blocking access. Sign-in risk levels categorize the riskiness of each sign-in attempt based on signals. Together, they help protect identities from compromise.

Related Microsoft Learn topic

Manage identities and governance in Azure

Question 10: Privileged Identity Management can provide just-in-time role activation in Azure.

• True
• False

The correct answer is True.

Privileged Identity Management provides just-in-time access to Azure AD and Azure resources, allowing users to activate roles for a limited time. This reduces standing privileged access and minimizes risk. It also includes approval workflows and access reviews for better governance.

Related Microsoft Learn topic

Privileged Identity Management overview

Question 11: Microsoft Entra Domain Services require you to manage domain controllers manually.

• True
• False

The correct answer is False.

Microsoft Entra Domain Services provides managed domain controllers so you do not have to administer or patch them yourself. It automatically handles replication and updates. This allows you to use domain services without deploying domain controller VMs.

Related Microsoft Learn topic

Manage identities and governance in Azure

Question 12: Access packages in Entitlement Management can include both applications and SharePoint sites.

• True
• False

The correct answer is True.

Access packages can contain resources such as enterprise applications, Microsoft 365 groups, and SharePoint sites. Users request access to a package, and Entitlement Management automates the process. This simplifies access management across different resource types.

Related Microsoft Learn topic

Microsoft Entra entitlement management

Question 13: What is the purpose of Azure File Sync?

• Centralize file shares in Azure
• Encrypt data at rest
• Monitor file requests
• Scale virtual networks

The correct answer is Centralize file shares in Azure.

Azure File Sync synchronizes on-premises Windows Server file shares with Azure Files, allowing tiering of older files to the cloud. It provides a consistent namespace for users and reduces on-premises storage needs. It also supports cloud backups.

Related Microsoft Learn topic

Azure File Sync overview

Question 14: Which storage tier is optimized for infrequently accessed data in Azure Blob Storage?

• Hot
• Cool
• Archive
• Premium

The correct answer is Cool.

The Cool tier is designed for blob data that is infrequently accessed but needs to be available immediately. It offers lower storage costs compared to Hot, with higher access costs. The Archive tier is even cheaper but has higher retrieval latency.

Related Microsoft Learn topic

Blob access tiers

Question 15: What feature allows you to mount an Azure Blob container as a file share?

• Blobfuse
• Azure Data Lake
• Azure Files Premium
• Azure Backup

The correct answer is Blobfuse.

Blobfuse is an open-source project that provides a virtual filesystem driver for Azure Blob Storage. It allows Linux clients to mount a blob container as if it were a local file system. This enables applications to access blob storage using POSIX file APIs.

Related Microsoft Learn topic

Mount Azure Blob Storage by using BlobFuse

Question 16: How can you enable automatic data movement between storage tiers?

• Configure lifecycle management policies
• Use Access Control Lists
• Enable soft delete
• Set up virtual network rules

The correct answer is Configure lifecycle management policies.

Lifecycle management policies allow you to define rules to automatically transition blobs between Hot, Cool, and Archive tiers based on last modified time. This helps optimize costs by moving less-active data to cheaper tiers.

Related Microsoft Learn topic

Azure Blob Storage lifecycle management

Question 17: Which tasks are needed to secure access to an Azure Storage account? Choose 2 answers.

• Configure firewall and virtual network rules
• Manage shared key rotation
• Deploy ARM templates
• Set up Azure Backup
• Assign built-in roles

The correct answers are Configure firewall and virtual network rules and Assign built-in roles.

Configuring firewall and VNet rules restricts network access to the storage account. Assigning built-in roles grants or restricts user permissions for storage operations. Together, they secure access at both network and identity levels.

Related Microsoft Learn topic

Implement and manage storage in Azure

Question 18: Which operations can be performed with Azure Storage Explorer? Choose 2 answers.

• Upload blobs
• Configure network security groups
• Edit queue messages
• Manage VM disks
• View storage metrics

The correct answers are Upload blobs and Edit queue messages.

Azure Storage Explorer is a standalone app that allows you to visually manage Azure Storage resources. You can upload, download, and delete blobs; manage queues; and work with table storage. It does not manage network or VM disk resources.

Related Microsoft Learn topic

Azure Storage Explorer overview

Question 19: Which features support encryption of data at rest in Azure Storage? Choose 2 answers.

• Server-side encryption
• Client-side encryption
• Storage firewall rules
• Azure Defender for Storage
• Data Redundancy

The correct answers are Server-side encryption and Client-side encryption.

Server-side encryption automatically encrypts data before storing it and decrypts it when retrieved. Client-side encryption requires you to encrypt data before sending it to Azure. Both methods ensure data is encrypted at rest.

Related Microsoft Learn topic

Azure Storage encryption for data at rest

Question 20: Azure Managed Disks provide encryption by default at rest.

• True
• False

The correct answer is True.

Azure Managed Disks are encrypted at rest using server-side encryption with a Microsoft-managed key by default. You can also use customer-managed keys in Azure Key Vault for added control. This ensures data on the disk is protected against unauthorized access.

Related Microsoft Learn topic

Azure Storage encryption for data at rest

Question 21: Changing the performance tier for a Premium SSD disk can be done without creating a new disk.

• True
• False

The correct answer is True.

For Premium SSD managed disks, Azure allows the performance tier to be changed after deployment without changing the disk size and without downtime. This means you do not need to create a new disk only to adjust the supported performance tier. Some limits still apply, so administrators should review the disk type and tier restrictions before making the change.

Related Microsoft Learn topic

Change the performance tier of a managed disk

Question 22: Which Azure service provides fully managed Kubernetes clusters?

• Azure Kubernetes Service
• Azure Container Instances
• Azure Service Fabric
• Azure Functions

The correct answer is Azure Kubernetes Service.

AKS provides a managed Kubernetes control plane and automates tasks like patching and scaling. It simplifies container orchestration and integrates with Azure networking and storage. This allows you to focus on your applications rather than cluster management.

Related Microsoft Learn topic

Azure Kubernetes Service overview

Question 23: What service is used to manage infrastructure as code for Azure?

• Azure Resource Manager
• Azure DevOps
• Azure Automation
• Azure CLI

The correct answer is Azure Resource Manager.

ARM templates define Azure resources declaratively as JSON files. They allow you to deploy, update, and manage resources consistently. This ensures repeatable deployments and integrates with CI/CD pipelines for automation.

Related Microsoft Learn topic

Azure Resource Manager overview

Question 24: How can you resize a virtual machine in Azure?

• Select a new VM size in the Azure portal
• Edit the VM's JSON template
• Update the VM's Access Control List
• Modify the storage account key

The correct answer is Select a new VM size in the Azure portal.

You can resize a VM by choosing a different size that meets your performance requirements. Resizing may require the VM to be stopped and deallocated. The portal guides you through the available sizes for the VM's series.

Related Microsoft Learn topic

Sizes for virtual machines in Azure

Question 25: Which feature allows you to deploy multiple VMs based on a single image?

• Shared Image Gallery
• Azure Backup
• Azure Site Recovery
• Azure Policy

The correct answer is Shared Image Gallery.

A Shared Image Gallery lets you create and manage custom VM images, and replicate them across regions. You can version images and use them to deploy scale sets or individual VMs consistently. This streamlines large-scale image management.

Related Microsoft Learn topic

Azure Compute Gallery overview

Question 26: What is Azure Bastion primarily used for?

• Secure RDP/SSH without public IP
• Backing up VMs
• Scaling VMs automatically
• Monitoring VM performance

The correct answer is Secure RDP/SSH without public IP.

Azure Bastion provides a managed jump-box service in the Azure Portal that allows you to connect to VMs over SSL via RDP or SSH. It eliminates the need for exposing VM public IPs. This reduces attack surface and improves security.

Related Microsoft Learn topic

Azure Bastion overview

Question 27: Which Azure Disk type is best for mission-critical workloads?

• Ultra Disk
• Standard HDD
• Standard SSD
• Blob Storage

The correct answer is Ultra Disk.

Ultra Disks deliver sub-millisecond latency and high IOPS for performance-sensitive workloads. They allow dynamic performance adjustments independently of VM size. This makes them ideal for databases and high-performance applications.

Related Microsoft Learn topic

Azure managed disk types

Question 28: Which tasks are part of configuring Azure VM availability? Choose 2 answers.

• Create an availability set
• Configure network security group
• Assign user roles
• Enable Azure Backup
• Deploy availability zones

The correct answers are Create an availability set and Deploy availability zones.

An availability set distributes VMs across fault and update domains to avoid single points of failure. Availability zones replicate resources across separate physical locations in a region. Both approaches enhance VM resilience.

Related Microsoft Learn topic

Availability options for Azure Virtual Machines

Question 29: Which capabilities are provided by Azure Virtual Machine Scale Sets? Choose 2 answers.

• Automatic OS patching
• Automatic scaling
• Managed hardware replacement
• Built-in load balancing
• Network security

The correct answers are Automatic scaling and Built-in load balancing.

VM Scale Sets allow you to define a set of identical VMs that automatically scale in or out based on metrics. They also integrate with Azure Load Balancer or Application Gateway for distributing traffic across VM instances.

Related Microsoft Learn topic

Virtual Machine Scale Sets overview

Question 30: Which resources might you configure to support high performance compute workloads? Choose 2 answers.

• High performance GPU VMs
• Azure Batch
• Azure Logic Apps
• Azure App Service
• Azure Container Registry

The correct answers are High performance GPU VMs and Azure Batch.

GPU VMs are designed for intensive compute tasks like AI and rendering. Azure Batch provides job scheduling and scaling for large parallel workloads. Together, they support HPC scenarios effectively.

Related Microsoft Learn topic

Azure Batch overview

Question 31: You can attach up to 32 data disks to a single Azure VM.

• True
• False

The correct answer is True.

Azure VMs support attaching up to 32 data disks, depending on the VM series. Each attached data disk appears as a logical drive inside the VM. This allows you to expand storage capacity or separate data volumes for performance.

Related Microsoft Learn topic

Attach a managed data disk to a Windows VM

Question 32: Azure Dedicated Host is used to reserve physical servers for your VMs.

• True
• False

The correct answer is True.

Azure Dedicated Host provides physical servers that host only your Azure VMs. This ensures server-level isolation for compliance and licensing requirements. You maintain control over VM placement and can map to existing on-premises server-based licensing.

Related Microsoft Learn topic

Azure Dedicated Host overview

Question 33: Azure Availability Zones require VMs to be in separate subscriptions.

• True
• False

The correct answer is False.

Availability Zones are physical locations within an Azure region. You can deploy VMs in different zones under the same subscription and region. This provides high availability without needing multiple subscriptions.

Related Microsoft Learn topic

Azure compute documentation

Question 34: Which Azure service helps manage DNS records?

• Azure DNS
• Azure Traffic Manager
• Azure Firewall
• Azure Bastion

The correct answer is Azure DNS.

Azure DNS hosts DNS domains and provides name resolution using Microsoft’s global network. You can manage DNS records with the Azure portal or CLI. It integrates with Azure resource management to simplify name resolution for Azure resources.

Related Microsoft Learn topic

Azure Bastion overview

Question 35: What is the purpose of an Azure Application Gateway?

• Layer 7 load balancing
• Virtual network peering
• VPN connectivity
• Network routing

The correct answer is Layer 7 load balancing.

Application Gateway provides application-level routing and load balancing based on HTTP(S). It also supports SSL termination, URL-based routing, and the Web Application Firewall. This helps secure and optimize web applications.

Related Microsoft Learn topic

Azure Application Gateway overview

Question 36: Which Azure feature provides distributed denial-of-service protection?

• Azure DDoS Protection
• Network Security Groups
• Azure Firewall
• Azure Policy

The correct answer is Azure DDoS Protection.

Azure DDoS Protection defends against volumetric, protocol, and resource layer attacks. It automatically monitors traffic patterns and mitigates identified threats. This protects your Azure resources from external DDoS attacks.

Related Microsoft Learn topic

Azure DDoS Protection overview

Question 37: What does Azure Front Door help with?

• Global load balancing
• Virtual network creation
• Disk encryption
• Identity management

The correct answer is Global load balancing.

Azure Front Door is a global, scalable entry point that uses Microsoft's global network to route HTTP(S) traffic to the fastest and most available application backend. It also provides SSL offload, path-based routing, and caching.

Related Microsoft Learn topic

Azure Storage encryption for data at rest

Question 38: Which components can be part of a hub-spoke network topology in Azure? Choose 2 answers.

• Virtual network peerings
• Application Gateways
• Azure Monitor Alerts
• Route tables
• ExpressRoute circuits

The correct answers are Virtual network peerings and ExpressRoute circuits.

Virtual network peering connects hub and spoke VNets to allow resource communication. ExpressRoute circuits enable private connectivity from on-premises to the hub VNet. Together, they form a central hub for network traffic and connectivity.

Related Microsoft Learn topic

Azure Application Gateway overview

Question 39: Which tasks are involved in configuring a VPN Gateway? Choose 2 answers.

• Create a virtual network gateway
• Define gateway subnet
• Assign user roles
• Configure storage account
• Establish local network gateway

The correct answers are Create a virtual network gateway and Define gateway subnet.

The gateway subnet is a dedicated subnet for the VPN Gateway. Creating the virtual network gateway deploys the gateway resource. Establishing a local network gateway is also common, but the two core tasks are the gateway and its subnet.

Related Microsoft Learn topic

Azure VPN Gateway overview

Question 40: Which actions can be used to restrict inbound traffic to a subnet? Choose 2 answers.

• Associate Network Security Group
• Configure Azure Firewall rules
• Deploy Azure Monitor
• Enable DDoS Protection
• Create Application Security Group

The correct answers are Associate Network Security Group and Configure Azure Firewall rules.

NSGs define allow/deny rules at the subnet or NIC level. Azure Firewall provides a managed, cloud-based network security service. Both options restrict and filter inbound traffic effectively.

Related Microsoft Learn topic

Azure DDoS Protection overview

Question 41: Azure Route Server simplifies dynamic routing between your network virtual appliance and virtual networks.

• True
• False

The correct answer is True.

Azure Route Server enables you to exchange routing information between your network virtual appliance (NVA) and the Azure virtual network dynamically using BGP. This simplifies connecting NVAs and automates route management. It reduces manual route configuration.

Related Microsoft Learn topic

Azure Route Server overview

Question 42: ExpressRoute connections traverse the public internet.

• True
• False

The correct answer is False.

ExpressRoute provides a private, dedicated connection between your on-premises network and Azure datacenters, bypassing the public internet. This results in more reliable, faster connections with lower latencies and increased security. It is used for enterprise workloads requiring high throughput.

Related Microsoft Learn topic

Azure ExpressRoute overview

Question 43: Which Azure service would you use to centralize logs from multiple subscriptions?

• Azure Log Analytics workspace
• Azure Advisor
• Azure Security Center
• Azure Policy

The correct answer is Azure Log Analytics workspace.

A Log Analytics workspace collects and stores log data from multiple Azure services and subscriptions. You can run queries across all collected data to analyze and visualize it. This helps with troubleshooting and monitoring.

Related Microsoft Learn topic

Log Analytics workspace overview

Question 44: What is the primary purpose of Azure Service Health?

• Notify about Azure service incidents and maintenance
• Monitor network traffic
• Manage backup vaults
• Scale VMs

The correct answer is Notify about Azure service incidents and maintenance.

Azure Service Health alerts you to service issues affecting your resources, planned maintenance, and health advisories. It provides personalized alerts and guidance to mitigate issues. This helps you stay informed about platform events.

Related Microsoft Learn topic

Azure Service Health overview

Question 45: Which feature allows you to visualize metrics on a custom dashboard?

• Azure Monitor Metrics Explorer
• Azure Cost Management
• Azure Portal Favorites
• Azure AutoScale

The correct answer is Azure Monitor Metrics Explorer.

Metrics Explorer lets you chart and visualize performance metrics from various resources. You can pin charts to Azure dashboards to create custom views. This helps you track resource health and performance in one place.

Related Microsoft Learn topic

Analyze metrics with Azure Monitor metrics explorer

Question 46: Which tasks are part of troubleshooting Azure resource issues? Choose 2 answers.

• Use Azure Resource Health
• Run packet captures with Network Watcher
• Deploy ARM templates
• Analyze activity logs
• Configure VM scale sets

The correct answers are Use Azure Resource Health and Analyze activity logs.

Azure Resource Health provides information about the health of individual resources. Analyzing activity logs helps you understand operations performed on resources. Both tasks are essential in diagnosing and resolving issues.

Related Microsoft Learn topic

Virtual Machine Scale Sets overview

Question 47: Which tools help monitor container performance in Azure? Choose 2 answers.

• Azure Monitor for Containers
• Azure App Insights
• Azure Backup
• Azure Automation
• Azure DevOps pipelines

The correct answers are Azure Monitor for Containers and Azure App Insights.

Azure Monitor for Containers collects performance metrics from Kubernetes clusters. Application Insights provides application-level telemetry for containerized apps. Together, they offer end-to-end visibility into container health and performance.

Related Microsoft Learn topic

Azure Monitor Container insights overview

Question 48: Azure Advisor provides personalized best practice recommendations for Azure resources.

• True
• False

The correct answer is True.

Azure Advisor analyzes your resource configurations and usage telemetry to offer recommendations for high availability, security, performance, and cost optimization. It provides actionable insights to improve your Azure environment. Regularly reviewing Advisor recommendations helps maintain best practices.

Related Microsoft Learn topic

Azure Advisor overview

Question 49: Configuring Azure Monitor alerts incurs no additional cost.

• True
• False

The correct answer is False.

While Azure Monitor itself may be free up to certain data ingestion limits, configuring and using alerts can generate additional costs based on the number of metrics, logs, and alert rules. It’s important to review pricing details to manage costs.

Related Microsoft Learn topic

Azure Monitor alerts overview

Question 50: Azure Service Health helps you understand planned maintenance events.

• True
• False

The correct answer is True.

Azure Service Health provides personalized notifications about upcoming maintenance and service issues that might affect your resources. It offers detailed information on maintenance schedules and mitigations. This allows you to plan and prepare for any potential impact.

Related Microsoft Learn topic

Azure Service Health overview

Microsoft Learn references

• Privileged Identity Management overview
• Microsoft Entra access reviews
• Microsoft Entra Connect Sync overview
• Microsoft Entra B2B collaboration
• Microsoft Entra Conditional Access overview
• Manage identities and governance in Azure
• Microsoft Entra entitlement management
• Azure File Sync overview
• Blob access tiers
• Mount Azure Blob Storage by using BlobFuse
• Azure Blob Storage lifecycle management
• Implement and manage storage in Azure
• Azure Storage Explorer overview
• Azure Storage encryption for data at rest
• Change the performance tier of a managed disk
• Azure Kubernetes Service overview
• Azure Resource Manager overview
• Sizes for virtual machines in Azure
• Azure Compute Gallery overview
• Azure Bastion overview
• Azure managed disk types
• Availability options for Azure Virtual Machines
• Virtual Machine Scale Sets overview
• Azure Batch overview
• Attach a managed data disk to a Windows VM
• Azure Dedicated Host overview
• Azure compute documentation
• Azure Application Gateway overview
• Azure DDoS Protection overview
• Azure VPN Gateway overview
• Azure Route Server overview
• Azure ExpressRoute overview
• Log Analytics workspace overview
• Azure Service Health overview
• Analyze metrics with Azure Monitor metrics explorer
• Azure Monitor Container insights overview
• Azure Advisor overview
• Azure Monitor alerts overview
• Azure Administrator Associate certification