AZ-104 Practice Test 2 – 50 Questions and Answers (Azure Administrator, Updated August 2026)

AZ-104 Practice Test 3: 50 Updated Questions and Answers for Azure Administrator

Published July 6, 2025 · Updated August 1, 2026

Practice AZ-104 questions aligned with the Microsoft Azure Administrator skills measured as of April 17, 2026. This updated test covers Azure identities and governance, storage, compute, virtual networking, monitoring, backup, and recovery. Select your answers, review the explanations, and track your progress in the Learning Dashboard.

Exam: AZ-104Questions: 50Recommended score: 70%+Time: 90 minutes

Before you start

This practice test includes single-choice, multiple-response, and true/false questions. When a question requires more than one answer, the question text tells you exactly how many answers to choose.

AZ-104 practice test questions

Question 1: You assign the Reader role to Group1 at a management group. Where is the assignment inherited?

• By subscriptions and resources beneath the management group
• Only by the management group itself
• By every subscription in the Microsoft Entra tenant
• Only by newly created resource groups

The correct answer is By subscriptions and resources beneath the management group.

Azure RBAC assignments inherit from parent scopes. A role assigned at a management group applies to its descendant subscriptions, resource groups, and resources unless access is otherwise constrained.

Related Microsoft Learn topic

Understand scope for Azure RBAC

Question 2: A team must manage virtual machines in RG1 but must not grant access to resources in other resource groups. At which scope should you assign the Virtual Machine Contributor role?

• Subscription
• RG1
• Individual virtual machine
• Management group

The correct answer is RG1.

A resource-group assignment covers all applicable virtual machines in RG1 while avoiding permissions elsewhere. This follows the least-privilege principle.

Related Microsoft Learn topic

Understand scope for Azure RBAC

Question 3: An auditor needs a consolidated view of policy compliance for all resources in Subscription1. Which Azure service page should you use?

• Cost Management analysis
• Azure Advisor recommendations
• Azure Policy Compliance
• Microsoft Entra audit logs

The correct answer is Azure Policy Compliance.

The Azure Policy Compliance page summarizes compliant and non-compliant resources and assignments at the selected Azure Resource Manager scope.

Related Microsoft Learn topic

Get Azure Policy compliance data

Question 4: A subscription should notify the finance team when forecasted monthly cost reaches 80 percent of a configured amount. What should you create?

• A reservation utilization report
• An Azure Advisor workbook
• A policy remediation task
• A Cost Management budget with a forecasted alert

The correct answer is A Cost Management budget with a forecasted alert.

Budgets can evaluate actual or forecasted cost percentages and send notifications or invoke action groups when thresholds are reached.

Related Microsoft Learn topic

Create and manage Azure budgets

Question 5: Resources are frequently deployed without the required CostCenter tag. You need Azure Policy to add the tag automatically to existing and new supported resources. Which policy effect should you use?

• Modify
• AuditIfNotExists
• Deny
• Manual

The correct answer is Modify.

The Modify effect can add or update supported resource properties such as tags. Existing non-compliant resources can be corrected through a remediation task.

Related Microsoft Learn topic

Azure Policy Modify effect

Question 6: You need to delegate user administration for only the Europe division in Microsoft Entra ID. Which object should contain the division users?

• A management group
• An administrative unit
• An Azure subscription
• A resource group

The correct answer is An administrative unit.

Administrative units restrict the scope of supported Microsoft Entra administrative roles to a defined subset of directory objects.

Related Microsoft Learn topic

Administrative units in Microsoft Entra ID

Question 7: A user needs access to Azure resources for two hours only. Which Azure RBAC role-assignment property should you configure when supported?

• Condition
• Description
• Start and end time
• DelegatedManagedIdentityResourceId

The correct answer is Start and end time.

Time-bound eligible or active role assignments can be configured through Microsoft Entra Privileged Identity Management so access expires automatically.

Related Microsoft Learn topic

Assign Azure resource roles in PIM

Question 8: Which two Azure Resource Manager scopes can contain policy assignments? Choose 2 answers.

• A management group
• A network interface IP configuration
• A Microsoft Entra security group
• A resource group

The correct answers are A management group and A resource group.

Azure Policy assignments can target management groups, subscriptions, resource groups, or individual resources. Directory groups and nested resource properties are not ARM policy scopes.

Related Microsoft Learn topic

Scope in Azure Policy

Question 9: Which two operations are blocked by a CanNotDelete lock on a resource? Choose 2 answers.

• Reading the resource
• Deleting the resource
• Deleting the locked resource group that contains it
• Updating supported resource properties

The correct answers are Deleting the resource and Deleting the locked resource group that contains it.

A CanNotDelete lock allows modifications but blocks deletion of the protected resource. A parent resource group cannot be deleted while it contains a locked resource.

Related Microsoft Learn topic

Lock Azure resources

Question 10: Which two capabilities are provided by Azure management groups? Choose 2 answers.

• Organize subscriptions into a hierarchy
• Store application secrets
• Apply governance above the subscription scope
• Provide network routing between subscriptions

The correct answers are Organize subscriptions into a hierarchy and Apply governance above the subscription scope.

Management groups provide a hierarchy above subscriptions and allow policy and access assignments to inherit across descendant scopes.

Related Microsoft Learn topic

Azure management groups overview

Question 11: A tag applied to a resource group is not automatically inherited by resources unless a policy or deployment process adds it.

• True
• False

The correct answer is True.

Azure tags do not inherit automatically from a resource group to its resources. Azure Policy can be used to append or inherit required tags.

Related Microsoft Learn topic

Use tags to organize Azure resources

Question 12: The Owner role can manage all resources but cannot assign Azure RBAC roles.

• True
• False

The correct answer is False.

Owner includes full resource management permissions and permission to assign Azure RBAC roles. Contributor manages resources but cannot assign roles.

Related Microsoft Learn topic

Privileged administrator roles

Question 13: A storage account must survive a complete regional outage and allow read access from the secondary region before Microsoft initiates failover. Which redundancy option should you select?

• LRS
• ZRS
• GRS
• RA-GRS

The correct answer is RA-GRS.

Read-access geo-redundant storage replicates data to a secondary region and exposes a secondary read endpoint before failover.

Related Microsoft Learn topic

Azure Storage redundancy

Question 14: A service SAS might have been exposed. It was signed by a stored access policy. How can you revoke it without rotating the storage account keys?

• Delete or change the stored access policy
• Disable blob versioning
• Change the container access tier
• Regenerate the user delegation key

The correct answer is Delete or change the stored access policy.

A service SAS associated with a stored access policy can be revoked by deleting the policy or changing its validity. Ad hoc SAS tokens cannot be revoked this way.

Related Microsoft Learn topic

Shared access signatures overview

Question 15: Users need to cache an Azure file share on a Windows Server and synchronize changes to Azure Files. Which service should you deploy?

• Azure Data Box Gateway
• Azure File Sync
• Blob inventory
• Storage Explorer

The correct answer is Azure File Sync.

Azure File Sync centralizes file shares in Azure Files while Windows Servers act as local caches that synchronize through registered server endpoints.

Related Microsoft Learn topic

Azure File Sync overview

Question 16: You need to restore an earlier state of a block blob after it was overwritten, while retaining each committed change automatically. Which feature should you enable?

• Change feed only
• Container soft delete
• Blob versioning
• Archive access tier

The correct answer is Blob versioning.

Blob versioning automatically creates a previous version when a block blob is modified or deleted, enabling recovery of earlier data.

Related Microsoft Learn topic

Blob versioning

Question 17: An application must access blobs by using Microsoft Entra credentials and must not use account keys. Which built-in role grants read-only blob data access?

• Reader
• Storage Account Contributor
• Storage Blob Data Contributor
• Storage Blob Data Reader

The correct answer is Storage Blob Data Reader.

Storage Blob Data Reader grants read access to blob containers and data through Azure RBAC without granting management or write permissions.

Related Microsoft Learn topic

Azure built-in roles for Storage

Question 18: You must copy millions of on-premises files to Azure Blob Storage by using a command-line utility optimized for data transfer. Which tool should you use?

• AzCopy
• Azure Cloud Shell storage mount
• Azure Resource Mover
• Azure Import/Export journal only

The correct answer is AzCopy.

AzCopy is a command-line utility optimized for high-performance transfer of blobs and files to and from Azure Storage.

Related Microsoft Learn topic

Transfer data with AzCopy

Question 19: Which two settings can be configured in an Azure Blob lifecycle management rule? Choose 2 answers.

• An Azure RBAC role assignment
• A condition based on days since modification
• A private DNS zone link
• An action to move a blob to a cooler tier

The correct answers are A condition based on days since modification and An action to move a blob to a cooler tier.

Lifecycle policies use filters and age-based conditions to tier or delete eligible blobs. They do not manage identity or DNS configuration.

Related Microsoft Learn topic

Azure Blob Storage lifecycle management

Question 20: Which two authentication methods can AzCopy use for supported Azure Storage transfers? Choose 2 answers.

• Microsoft Entra ID
• An NSG service tag
• A SAS token
• An Azure Policy definition

The correct answers are Microsoft Entra ID and A SAS token.

AzCopy supports Microsoft Entra authorization and SAS-based authorization for appropriate transfers. Network and policy objects do not authenticate a data operation.

Related Microsoft Learn topic

Authorize AzCopy with Microsoft Entra ID

Question 21: Changing a blob from the Archive tier to an online tier can require hours before the blob becomes readable.

• True
• False

The correct answer is True.

Archive data is offline. Rehydrating it to Hot, Cool, or Cold can take hours depending on the selected priority and service conditions.

Related Microsoft Learn topic

Rehydrate an archived blob

Question 22: A storage account configured with LRS stores synchronous copies across multiple Azure regions.

• True
• False

The correct answer is False.

Locally redundant storage maintains copies within a single physical location in the primary region. Geo-redundant options replicate to another region.

Related Microsoft Learn topic

Azure Storage redundancy

Question 23: You need virtual machines to remain available if one datacenter in an Azure region fails. Which placement option should you use?

• An availability set
• Availability zones
• A proximity placement group
• A dedicated host group in one zone

The correct answer is Availability zones.

Availability zones place resources in separate physical locations within a region, protecting supported workloads from a datacenter-level failure.

Related Microsoft Learn topic

Availability zones overview

Question 24: A VM scale set must update all instances automatically after you change the model. Which upgrade policy mode should you use?

• Manual
• Rolling with no health monitoring
• Automatic
• A capacity reservation

The correct answer is Automatic.

Automatic upgrade mode applies model changes to all scale-set instances automatically. Rolling mode is preferred when controlled batches and health checks are required.

Related Microsoft Learn topic

Upgrade policies for VM scale sets

Question 25: You need to execute a one-time PowerShell command inside an Azure VM even though inbound RDP is blocked. Which feature should you use?

• Boot diagnostics
• Serial console screenshot
• Custom data
• Run Command

The correct answer is Run Command.

Run Command uses the VM agent to execute scripts inside a VM without requiring inbound management ports.

Related Microsoft Learn topic

Run Command overview

Question 26: You want to preview how an ARM template deployment will change existing resources without applying the changes. Which operation should you run?

• What-if
• Validate only
• Export template
• Deployment history

The correct answer is What-if.

The ARM what-if operation predicts resource additions, deletions, and modifications without performing the deployment.

Related Microsoft Learn topic

ARM template what-if operation

Question 27: A custom domain on an App Service app requires TLS without purchasing or importing a certificate. Which option should you use?

• An Application Gateway listener
• An App Service managed certificate
• A deployment slot setting
• A private certificate authority on the VM

The correct answer is An App Service managed certificate.

App Service can create and renew a free managed certificate for eligible custom domains, avoiding manual certificate purchase and rotation.

Related Microsoft Learn topic

Add and manage TLS certificates in App Service

Question 28: An Azure Container Instance should restart only when its process exits with a nonzero code. Which restart policy should you set?

• Always
• Never
• OnFailure
• UnlessStopped

The correct answer is OnFailure.

The OnFailure restart policy restarts containers that terminate unsuccessfully and leaves successfully completed containers stopped.

Related Microsoft Learn topic

Container restart policies

Question 29: A CI pipeline needs permission to push images to Azure Container Registry but must not manage the registry resource. Which role should you assign?

• Reader
• Contributor
• AcrPull
• AcrPush

The correct answer is AcrPush.

AcrPush grants push and pull permissions for registry artifacts without granting management-plane control over the registry.

Related Microsoft Learn topic

Azure Container Registry roles and permissions

Question 30: You need reusable Bicep code that deploys a storage account and can be called from several templates. What should you create?

• A Bicep module
• A deployment slot
• A VM extension
• An availability set

The correct answer is A Bicep module.

Bicep modules encapsulate reusable resource definitions and expose parameters and outputs to the consuming Bicep file.

Related Microsoft Learn topic

Bicep modules

Question 31: Which two resources can be deployed by an Azure Resource Manager template? Choose 2 answers.

• A local Windows user
• An Azure virtual network
• A browser cookie
• An Azure App Service plan

The correct answers are An Azure virtual network and An Azure App Service plan.

ARM templates declaratively deploy Azure Resource Manager resources. Local operating-system accounts and client browser state are outside ARM resource deployment.

Related Microsoft Learn topic

ARM template overview

Question 32: Which two actions are supported during an App Service slot swap? Choose 2 answers.

• Preview the swap
• Convert the app to a virtual machine
• Swap selected app settings and content
• Move the App Service plan to another region automatically

The correct answers are Preview the swap and Swap selected app settings and content.

App Service supports swap with preview and exchanges deployable content and configuration between slots while sticky settings remain with their slots.

Related Microsoft Learn topic

Set up staging environments in App Service

Question 33: A Bicep deployment is converted to an ARM JSON template before Azure Resource Manager deploys it.

• True
• False

The correct answer is True.

Bicep provides concise authoring syntax and is transpiled into an ARM template that Azure Resource Manager processes.

Related Microsoft Learn topic

What is Bicep?

Question 34: An Azure Container Registry image can be pulled anonymously from every registry by default.

• True
• False

The correct answer is False.

Registry access requires authentication by default. Anonymous pull is an optional feature for supported registries and must be explicitly enabled.

Related Microsoft Learn topic

Anonymous pull access in Azure Container Registry

Question 35: VNet1 is peered with VNet2, and VNet2 is peered with VNet3. No other routing is configured. Can a VM in VNet1 reach VNet3 through VNet2?

• Yes, peering is transitive
• No, virtual network peering is not transitive
• Yes, if all VNets use different subscriptions
• No, because peering works only in one region

The correct answer is No, virtual network peering is not transitive.

Peering connects only the directly peered virtual networks. Transit requires additional connectivity or a routing design such as a hub network with an appliance or gateway.

Related Microsoft Learn topic

Virtual network peering

Question 36: A user-defined route sends traffic to a network virtual appliance. Which VM setting must be enabled on the appliance network interface so it can forward traffic not addressed to itself?

• Accelerated networking
• A public IP address
• IP forwarding
• A service endpoint

The correct answer is IP forwarding.

A network virtual appliance that forwards routed packets must have IP forwarding enabled on its network interface and in its operating system.

Related Microsoft Learn topic

Network interface IP forwarding

Question 37: A Standard Load Balancer should stop sending new flows to an unhealthy backend VM. What must you configure?

• An application security group
• A NAT Gateway
• A private DNS zone
• A health probe

The correct answer is A health probe.

The load balancer uses health probes to determine which backend instances can receive new flows.

Related Microsoft Learn topic

Azure Load Balancer health probes

Question 38: You want an NSG rule to target a logical group of VM network interfaces without listing their IP addresses. What should you use?

• An application security group
• A route filter
• A public IP prefix
• A DNS forwarding ruleset

The correct answer is An application security group.

Application security groups let NSG rules refer to groups of network interfaces by application role instead of explicit IP addresses.

Related Microsoft Learn topic

Application security groups

Question 39: A subnet needs private access to Azure Storage while the storage service continues to use its public endpoint and public DNS name. Which feature should you enable on the subnet?

• A private endpoint for every VM
• A Microsoft.Storage service endpoint
• An inbound NAT rule
• Gateway transit

The correct answer is A Microsoft.Storage service endpoint.

A service endpoint extends the subnet identity to the Azure Storage public service endpoint over the Azure backbone. Storage firewall rules can then allow the subnet.

Related Microsoft Learn topic

Virtual network service endpoints

Question 40: Which two statements about Azure virtual network peering are correct? Choose 2 answers.

• Traffic between peered VNets uses the Microsoft backbone
• Peering automatically provides a transitive route to every connected VNet
• Peered VNets must have identical address spaces
• Peered VNets must have non-overlapping address spaces

The correct answers are Traffic between peered VNets uses the Microsoft backbone and Peered VNets must have non-overlapping address spaces.

Peering uses private backbone connectivity and requires non-overlapping address spaces. It is not transitive.

Related Microsoft Learn topic

Virtual network peering

Question 41: Which two resources are required for an Azure site-to-site VPN connection? Choose 2 answers.

• An Application Gateway
• A virtual network gateway
• A local network gateway
• A NAT Gateway

The correct answers are A virtual network gateway and A local network gateway.

A site-to-site VPN uses an Azure VPN gateway and a local network gateway that represents the on-premises VPN device and address prefixes.

Related Microsoft Learn topic

Create a site-to-site VPN connection

Question 42: An NSG rule with a lower numeric priority is evaluated before a rule with a higher numeric priority.

• True
• False

The correct answer is True.

NSG rules are processed in ascending priority order. The first matching rule determines whether the traffic is allowed or denied.

Related Microsoft Learn topic

Network security groups overview

Question 43: A service endpoint assigns a private IP address from your subnet to the Azure PaaS resource.

• True
• False

The correct answer is False.

A private endpoint receives a private IP in the subnet. A service endpoint secures access to the service public endpoint by extending the subnet identity.

Related Microsoft Learn topic

Virtual network service endpoints

Question 44: You need platform metrics and resource logs from a storage account sent to a Log Analytics workspace. What should you configure on the storage account?

• A resource lock
• A backup policy
• A diagnostic setting
• A route table

The correct answer is A diagnostic setting.

Diagnostic settings route supported platform logs and metrics to destinations such as Log Analytics, Storage, and Event Hubs.

Related Microsoft Learn topic

Diagnostic settings in Azure Monitor

Question 45: An Azure Monitor alert must notify email, SMS, and an automation runbook. Which reusable resource should contain these notification and action targets?

• A data collection endpoint
• A recovery plan
• A metric namespace
• An action group

The correct answer is An action group.

Action groups define reusable notification receivers and automated actions that alert rules invoke.

Related Microsoft Learn topic

Azure Monitor action groups

Question 46: You need Microsoft notifications about planned maintenance and regional Azure service incidents that may affect your subscriptions. Which service should you use?

• Azure Service Health
• Resource Health only
• Application Insights availability tests
• Network Watcher

The correct answer is Azure Service Health.

Service Health provides personalized information and alerts for Azure service incidents, planned maintenance, and health advisories affecting subscribed services and regions.

Related Microsoft Learn topic

Azure Service Health overview

Question 47: A protected Azure VM was deleted accidentally. Azure Backup soft delete is enabled. What happens to its backup data during the soft-delete retention period?

• It is moved immediately to Archive storage
• It remains recoverable in a soft-deleted state
• It is exported to another region
• It can be restored only after recreating the original VM

The correct answer is It remains recoverable in a soft-deleted state.

Soft delete retains deleted backup data for the configured period so an authorized operator can undelete and recover it.

Related Microsoft Learn topic

Soft delete for Azure Backup

Question 48: Which two destinations can an Azure Monitor diagnostic setting use? Choose 2 answers.

• A Log Analytics workspace
• An NSG application security group
• An Event Hubs namespace
• A management group

The correct answers are A Log Analytics workspace and An Event Hubs namespace.

Diagnostic settings can send supported logs and metrics to Log Analytics, Azure Storage, Event Hubs, or certain partner solutions.

Related Microsoft Learn topic

Diagnostic settings in Azure Monitor

Question 49: A Recovery Services vault can protect multiple supported data sources in the same Azure region as the vault.

• True
• False

The correct answer is True.

A Recovery Services vault stores and manages recovery points for supported workloads, subject to regional and workload-specific requirements.

Related Microsoft Learn topic

Recovery Services vault overview

Question 50: Deleting an Azure Monitor alert rule also deletes the Log Analytics workspace queried by that rule.

• True
• False

The correct answer is False.

An alert rule references its monitored resource or workspace. Deleting the rule does not delete the underlying Log Analytics workspace.

Related Microsoft Learn topic

Azure Monitor alerts overview