AZ-104 sample exam questions

15 exam-style questions for Microsoft AZ-104: Azure Administrator, with answers and explanations. Take them as a timed practice exam first if you want a score out of 1000.

Take the free practice exam AZ-104 exam guide
  1. Question 1Single choiceTopic 1
    Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory domain.
    The on-premise virtual environment consists of virtual machines (VMs) running on Windows Server 2012 R2 Hyper-V host servers.
    You have created some PowerShell scripts to automate the configuration of newly created VMs. You plan to create several new VMs.
    You need a solution that ensures the scripts are run on the new VMs.
    Which of the following is the best solution?
    1. A
      Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory.
    2. B
      Configure a Group Policy Object (GPO) to run the scripts as logon scripts.
    3. C
      Configure a Group Policy Object (GPO) to run the scripts as startup scripts.
    4. D
      Place the scripts in a new virtual hard disk (VHD).
    Show answer

    Correct answer: A

    Why

    The community vote for GPO startup scripts is close but the intended answer is SetupComplete.cmd: Windows Setup runs the SetupComplete.cmd file in the Windows Setup Scripts folder once on every new VM built from the image, before first logon, without depending on domain join. GPO scripts need the VM joined and rerun on every boot or logon.

  2. Question 2Single choiceTopic 2
    You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.

    Subscription1 has a user named User1. User1 has the following roles:

    • Reader
    • Security Admin
    • Security Reader

    You need to ensure that User1 can assign the Reader role for VNet1 to other users.

    What should you do?
    1. A
      Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
    2. B
      Assign User1 the Access Administrator role for VNet1.
    3. C
      Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
    4. D
      Assign User1 the Network Contributor role for RG1.
    Show answer

    Correct answer: B

    Why

    The intended answer is the User Access Administrator role (shown here as Access Administrator) on VNet1, which lets User1 manage role assignments, such as Reader, for that resource. Contributor and Network Contributor cannot assign roles.

  3. Question 3HotspotTopic 2
    HOTSPOT

    You have a Microsoft Entra tenant that is linked to the subscriptions shown in the following table.



    You have the resource groups shown in the following table.



    You assign roles to users as shown in the following table.



    For each of the following statements, select Yes if the statement is true. Otherwise, select No.

    NOTE: Each correct selection is worth one point.

    User1 can resize VM1.Yes / No
    User2 can create a new storage account in RG1.Yes / No
    User3 can assign User1 the Owner role for RG3.Yes / No
    Show answer
    • User1 can resize VM1. Yes
    • User2 can create a new storage account in RG1. No
    • User3 can assign User1 the Owner role for RG3. Yes
    Why

    Contributor on MG2 flows down to Sub3, RG3 and VM1, so User1 can resize VM1. User2's role is scoped to storage1 only, so it cannot create storage accounts in RG1. User Access Administrator at the Tenant Root Group can assign any role on any child scope, including RG3.

  4. Question 4HotspotTopic 3
    HOTSPOT

    You have an Azure subscription that has offices in the East US and West US Azure regions.

    You plan to create the storage account shown in the following exhibit.



    Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

    NOTE: Each correct selection is worth one point.

    To minimize the network costs of accessing adatum22, modify the [answer choice] setting.Default routing tier / Endpoint type / Location / Network connectivity / Performance
    After adatum22 is created, you can modify the [answer choice] setting.Enable infrastructure encryption / Enable support for customer-managed keys / Encryption type / Premium account type
    Show answer
    • To minimize the network costs of accessing adatum22, modify the [answer choice] setting. Default routing tier
    • After adatum22 is created, you can modify the [answer choice] setting. Encryption type
    Why

    Internet routing costs less than Microsoft network routing, so change the default routing tier. After the account is created, you can switch the encryption type from Microsoft-managed to customer-managed keys. Infrastructure encryption, CMK scope and the premium account type can only be set at creation.

  5. Question 5Single choiceTopic 3
    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

    After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

    You have an Azure Storage account named storage1.

    You need to enable a user named User1 to list and regenerate storage account keys for storage1.

    Solution: You assign the Reader and Data Access role to User1.

    Does this meet the goal?
    1. A
      Yes
    2. B
      No
    Show answer

    Correct answer: B

    Why

    Reader and Data Access lets a user view resources and list storage account keys, but it lacks the regenerateKey action. User1 could list keys but not regenerate them, so this does not meet the goal.

  6. Question 6HotspotTopic 4
    HOTSPOT

    You are creating an Azure Kubernetes Services (AKS) cluster as shown in the following exhibit.



    Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

    NOTE: Each correct selection is worth one point.

    To ensure that you can create Windows containers in AKS1, you must [answer choice].enable virtual nodes / increase the number of node pools / modify the Kubernetes version setting / modify the Network configuration setting
    To ensure that you can integrate AKS1 with an Azure container registry, you must modify the [answer choice] setting.AKS-managed Azure Active Directory / Authentication method / Authorized IP ranges / Kubernetes version / Network configuration
    Show answer
    • To ensure that you can create Windows containers in AKS1, you must [answer choice]. modify the Network configuration setting
    • To ensure that you can integrate AKS1 with an Azure container registry, you must modify the [answer choice] setting. Authentication method
    Why

    In this exam version, Windows Server node pools need Azure CNI, so kubenet must be changed in Network configuration. Attaching ACR to AKS grants AcrPull to the cluster's identity, so use a managed identity as the authentication method instead of a service principal. Newer AKS releases relax some of these limits.

  7. Question 7Single choiceTopic 4
    You have an Azure subscription that has the public IP addresses shown in the following table.



    You plan to deploy an Instance of Azure Firewall Premium named FW1.

    Which IP addresses can you use?
    1. A
      IP2 only
    2. B
      IP1 and IP2 only
    3. C
      IP1, IP2, and IP5 only
    4. D
      IP1, IP2, IP4, and IP5 only
    Show answer

    Correct answer: B

    Why

    Azure Firewall requires Standard SKU, static, IPv4 public IP addresses; Basic SKU addresses (IP3, IP4) and IPv6 (IP5) are not supported. Within the given options, IP1 and IP2 are the intended answer, although Global-tier addresses are meant for the cross-region load balancer.

  8. Question 8Multiple responseTopic 5
    You have an Azure subscription that contains the resources shown in the following table.



    You create a public IP address named IP1.

    Which two resources can you associate to IP1? Each correct answer presents a complete solution.

    NOTE: Each correct selection is worth one point.
    1. A
      VM1
    2. B
      LB1
    3. C
      NIC1
    4. D
      VPN1
    5. E
      VNet1
    Show answer

    Correct answer: B, C

    Why

    A public IP address can be associated with a network interface's IP configuration (NIC1) or a load balancer frontend (LB1). VMs get public IPs through their NICs, not directly, VNets cannot have public IPs, and a VPN gateway's IP is set when the gateway is created.

  9. Question 9HotspotTopic 5
    HOTSPOT

    You have an Azure subscription that contains the virtual networks shown in the following table.



    The subscription contains the subnets shown in the following table.



    The subscription contains the storage accounts shown in the following table.



    You create a service endpoint policy named Policy1 in the South Central US Azure region to allow connectivity to all the storage accounts in the subscription.

    For each of the following statements, select Yes if the statement is true. Otherwise, select No.

    NOTE: Each correct selection is worth one point.

    Policy1 can be applied to Subnet3.Yes / No
    Only storage1 and storage2 can be accessed from VNet2.Yes / No
    Only storage2 can be accessed from VNet3.Yes / No
    Show answer
    • Policy1 can be applied to Subnet3. Yes
    • Only storage1 and storage2 can be accessed from VNet2. No
    • Only storage2 can be accessed from VNet3. No
    Why

    A service endpoint policy must be in the same region as the virtual network, and Subnet3 is in South Central US with a storage endpoint. VNet2 has no policy, so access is unfiltered. On VNet3, Policy1 allows all the accounts, not only storage2.

  10. Question 10HotspotTopic 6
    HOTSPOT

    You have an Azure subscription that contains the vaults shown in the following table.



    You deploy the virtual machines shown in the following table.



    You have the backup policies shown in the following table.



    For each of the following statements, select Yes if the statement is true. Otherwise, select No.

    NOTE: Each correct selection is worth one point.

    VM1 can be backed up by using Policy1.Yes / No
    VM2 can be backed up by using Policy3.Yes / No
    VM2 can be backed up by using Policy2.Yes / No
    Show answer
    • VM1 can be backed up by using Policy1. Yes
    • VM2 can be backed up by using Policy3. No
    • VM2 can be backed up by using Policy2. Yes
    Why

    Azure VM backup uses a Recovery Services vault, and a Standard policy supports VMs using Azure Disk Encryption. A Backup vault policy cannot protect Azure VMs, so Policy3 fails. Trusted launch VMs require an Enhanced policy, so Policy2 works for VM2.

  11. Question 11Single choiceTopic 6
    You have an Azure subscription. The subscription contains virtual machines that run Windows Server.

    You have a data collection rule (DCR) named Rule1.

    You plan to use the Azure Monitor Agent to collect events from Windows System event logs.

    You only need to collect system events that have an ID of 1001.

    Which type of query should you use for the data source in Rule1?
    1. A
      SQL
    2. B
      XPath
    3. C
      KQL
    Show answer

    Correct answer: B

    Why

    Data collection rules for the Azure Monitor Agent filter Windows events with XPath queries, for example System!*[System[(EventID=1001)]]. KQL is used later to query the collected data, or for transformations, and SQL is not supported for event filters.

  12. Question 12Single choiceTopic 7
    You need to meet the user requirement for Admin1.
    What should you do?
    1. A
      From the Azure Active Directory blade, modify the Groups
    2. B
      From the Azure Active Directory blade, modify the Properties
    3. C
      From the Subscriptions blade, select the subscription, and then modify the Access control (IAM) settings
    4. D
      From the Subscriptions blade, select the subscription, and then modify the Properties
    Show answer

    Correct answer: C

    Why

    The case study requires making Admin1 an administrator of the subscription. This is done from the subscription's Access control (IAM), where the classic Service administrator was also managed. Classic administrators were retired in 2024, so today you would assign the Owner role in IAM. Entra groups and properties do not grant subscription rights.

  13. Question 13Single choiceTopic 10
    You need to move the blueprint files to Azure.
    What should you do?
    1. A
      Generate an access key. Map a drive, and then copy the files by using File Explorer.
    2. B
      Use Azure Storage Explorer to copy the files.
    3. C
      Use the Azure Import/Export service.
    4. D
      Generate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer.
    Show answer

    Correct answer: B

    Why

    Azure Storage Explorer can copy the blueprint files directly into blob storage using Microsoft Entra or key-based access, with minimal setup. Mapping a drive works only for Azure Files over SMB and needs the account key, not a SAS, and Import/Export is for shipping large volumes on physical disks.

  14. Question 14Single choiceTopic 15
    You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort.

    What should you do?
    1. A
      Create a user-defined route from VNET1 to VNET3.
    2. B
      Create an NSG and associate the NSG to VM1 and VM4.
    3. C
      Assign VM4 an IP address of 10.0.1.5/24.
    4. D
      Establish peering between VNET1 and VNET3.
    Show answer

    Correct answer: D

    Why

    Peering VNET1 and VNET3 provides private, low-latency connectivity between VM1 and VM4 with minimal configuration because their address spaces do not overlap. UDRs need an existing network path, NSGs only filter, and readdressing VM4 does not place it on VNET1.

  15. Question 15Single choiceTopic 16
    You need to recommend a solution to automate the configuration for the finance department users. The solution must meet the technical requirements.
    What should you include in the recommendation?
    1. A
      Azure AD B2C
    2. B
      dynamic groups and conditional access policies
    3. C
      Azure AD Identity Protection
    4. D
      an Azure logic app and the Microsoft Identity Management (MIM) client
    Show answer

    Correct answer: B

    Why

    Dynamic groups automatically add finance department users based on attributes such as department, and Conditional Access policies targeting those groups enforce the required access settings, such as MFA, automatically. Azure AD B2C is for customer identities, Identity Protection is risk-based, and Logic Apps with MIM add unnecessary complexity.