Get Your CertAZ-104PlayCompete
‹ AZ-104 tests

Microsoft Azure Administrator Associate (AZ-104) practice questions

100 questions in 10 tests. Open one to answer it on its own, or take a whole test.

Test 1

Take Test 1 ›
  1. A user in your Microsoft Entra tenant is assigned the Reader role at the scope of subscription Sub1. Later, you assign the same user the Contributor role at the scope of the… · Identity & Governance
  2. Your finance team runs a production workload in the resource group RG-Prod. Recent incidents were caused by engineers deleting resources by mistake. You must prevent every user… · Identity & Governance
  3. Contoso hires roughly 40 people a month. Every new employee whose department attribute is set to Sales must automatically receive access to a set of Sales applications, with no… · Identity & Governance
  4. You are creating a general-purpose v2 storage account in a region that supports availability zones. The application team gives you two requirements: - Writes must keep succeeding… · Storage
  5. To cut costs, you add a blob lifecycle management policy to a general-purpose v2 storage account that moves block blobs in the audit-logs container to the archive tier 90 days… · Storage
  6. An application team runs a Virtual Machine Scale Set created in Uniform orchestration mode. New requirements have arrived: the instances must be protected by Azure Backup, and… · Compute
  7. Three web servers run as Azure VMs in a single availability set in the West Europe region. During a recent incident, a datacenter-level power and network failure took all three… · Compute
  8. Your hub-and-spoke topology in East US contains VNet-Hub, VNet-Spoke1, and VNet-Spoke2, with non-overlapping address spaces. VNet-Hub is peered to each spoke, and both peerings… · Virtual Networking
  9. The subnet snet-web is associated with a network security group that contains one custom inbound rule, Deny-Internet-In (priority 200, source Internet, any port, protocol Any… · Virtual Networking
  10. Six months ago a colleague created the Recovery Services vault rsv-prod in East US 2, set its storage replication type to Locally-redundant, and configured daily backups for 30… · Monitoring & Backup

Test 2

Take Test 2 ›
  1. An engineer who holds the Contributor role on the resource group RG-Apps tries to deploy a virtual machine into the South India region. The deployment fails immediately, before… · Identity & Governance
  2. You are authoring a custom role for a storage operations team. The definition contains several control-plane Actions, one DataActions entry… · Identity & Governance
  3. A contractor was given an ad hoc account SAS for the storage account stcontoso, signed with key1 and valid for another six months. The token has been posted in a public support… · Storage
  4. Contoso is a cloud-only organisation: every user account exists only in Microsoft Entra ID, there is no Active Directory Domain Services deployment anywhere, and the laptops are… · Storage
  5. A pipeline deploys an ARM template that defines a virtual network and a network security group into the existing resource group RG-Shared. After last night's run, the storage… · Compute
  6. A web app runs on an App Service plan in the Basic tier. Releases currently cause about two minutes of downtime, and the last rollback took an hour. The team wants to validate… · Compute
  7. A new security standard takes effect next week: - No virtual machine may have a public IP address. - No network security group may allow inbound TCP 3389 or 22 from the internet… · Virtual Networking
  8. An on-premises data centre reaches Azure over ExpressRoute private peering. A colleague enabled the Microsoft.Storage service endpoint on the snet-app subnet and then set the… · Virtual Networking
  9. You create a metric alert rule that fires when average CPU on a production VM exceeds 90% for five minutes. Overnight the VM is pinned at 99%, and the next morning the Alerts… · Monitoring & Backup
  10. Contoso has acquired Fabrikam. Contoso's governance policies are assigned to the management group mg-corp in the Contoso Microsoft Entra tenant. Fabrikam's five Azure… · Identity & Governance

Test 3

Take Test 3 ›
  1. Three external auditors from a partner firm need read-only access to one Azure subscription for a three-month engagement. Their firm has its own Microsoft Entra tenant. Contoso's… · Identity & Governance
  2. Using a Bicep pipeline (not the portal), you assign a built-in policy with a deployIfNotExists effect at subscription scope. The policy configures diagnostic settings on storage… · Identity & Governance
  3. A nightly job overwrote pricing.json in a general-purpose v2 account with a truncated file, and the previous contents could not be recovered. Investigating, you find that the… · Storage
  4. A media team in Singapore reads reference images from stmediauk, a general-purpose v2 account in UK South, and the read latency is hurting them. New images are uploaded to the UK… · Storage
  5. An audit finding says that the temporary disk and the OS and data disk caches on a fleet of Azure VMs are not encrypted at rest. The platform team adds two conditions: no… · Compute
  6. A team has containerised an HTTP API. They want a hosting option that scales out with HTTP request volume, scales to zero when nobody is calling it overnight, and can run two… · Compute
  7. An application's users have all relocated to the Midwest. The supporting virtual machines, their managed disks, NICs, network security groups, and an internal load balancer… · Compute
  8. A Standard public load balancer fronts three VMs in the subnet snet-web. The portal reports every backend instance as unhealthy and clients get no response. From a jump box in… · Virtual Networking
  9. You create the private DNS zone corp.internal and link it to VNet-App. VMs in VNet-App must resolve one another by host name, and new VMs must start resolving without anyone… · Virtual Networking
  10. A compromised administrator account was used yesterday to stop protection and delete the backup data for twelve VMs in the Recovery Services vault rsv-prod, and then to try to… · Monitoring & Backup

Test 4

Take Test 4 ›
  1. Contoso synchronises its on-premises Active Directory to Microsoft Entra ID with password hash synchronisation. You enable self-service password reset for a pilot group and… · Identity & Governance
  2. A development subscription overran its monthly allowance again. Finance asks you to "cap it at £5,000 so that it stops". Nobody in the team wants a manual watch rota, and the… · Identity & Governance
  3. To lock down the storage account stapp01, you set Public network access to Enabled from selected virtual networks and IP addresses, and you add a virtual network rule for the… · Storage
  4. An SMB Azure file share is mapped as drive S: on every finance workstation, and a scheduled job takes a share snapshot every hour. This morning an analyst saved over… · Storage
  5. A Virtual Machine Scale Set has one autoscale profile (minimum 2, maximum 20) containing four rules: - Scale out by 2 when average CPU > 75% - Scale out by 5 when the storage… · Compute
  6. Five web apps share one Standard S1 App Service plan. One of them runs a nightly report that pegs the CPU, and while it runs the other four apps become slow. You scaled the plan… · Compute
  7. An audit finds that everything touching the container registry acrcontoso authenticates with the registry's admin account: six developers pulling images from their laptops, and a… · Compute
  8. VNet-Hub has an ExpressRoute gateway whose on-premises peer advertises a default route (0.0.0.0/0) by BGP, so traffic from the spokes currently leaves through the customer's… · Virtual Networking
  9. The web tier of an application runs on VMs spread across two subnets of VNet-Prod. VMs are re-created regularly by a pipeline, and each rebuild changes their private IP… · Virtual Networking
  10. A security team wants to correlate, in one place and with KQL queries: - Key vault audit events and storage account read operations, and - who changed what in the subscription… · Monitoring & Backup

Test 5

Take Test 5 ›
  1. Four platform engineers need Contributor on the production subscription, but only while they are executing an approved change, roughly two evenings a month. Security requires… · Identity & Governance
  2. A university runs one Microsoft Entra tenant. The School of Business has its own IT team, and you must let that team: 1. Reset passwords and edit user properties for School of… · Identity & Governance
  3. A Linux analytics cluster needs a shared file system mounted over NFS 4.1, with consistently low latency and protection against the loss of a single availability zone in the… · Storage
  4. You must move about 800 GB of block blobs from a storage account in North Europe to a newly created account in UK South. It is a one-off migration, it has to run unattended from… · Storage
  5. Three VMs run in one availability set. You need to change one of them from Standard_D4s_v3 to Standard_E8s_v5 because the workload has become memory-bound. With the VM running… · Compute
  6. A team has built a hardened Windows Server VM with the corporate agents and configuration installed. They now need to deploy fresh VMs and scale set instances from it in three… · Compute
  7. A web app currently answers on contoso-web.azurewebsites.net and runs on a Free (F1) App Service plan. It must answer on www.contoso.com over HTTPS, using an App Service Managed… · Compute
  8. VNet-Spoke1 (10.1.0.0/16) is peered to VNet-Hub, and the peering has worked for months. VNet-Spoke1 has run out of addresses, so you add a second address range, 10.4.0.0/16… · Virtual Networking
  9. A developer reports that vm-app-01 cannot reach vm-sql-01 on TCP 1433. Both VMs are in the same virtual network. vm-sql-01 has a network security group on its network interface… · Virtual Networking
  10. Azure Site Recovery replicates twelve production VMs from West Europe to North Europe, and replication is healthy. An annual audit requires evidence that the application actually… · Monitoring & Backup

Test 6

Take Test 6 ›
  1. Twenty Azure VMs, deployed from the same template, each run a service that reads secrets from one Azure Key Vault. The operations team rebuilds these VMs regularly and does not… · Identity & Governance
  2. A company is onboarding 300 new employees and has their names, departments and usernames in a spreadsheet. The administrator needs to create all 300 member accounts in Microsoft… · Identity & Governance
  3. Finance needs every resource to carry a CostCenter tag so that spending can be charged back. The cloud team wants any attempt to create a resource in a subscription without that… · Identity & Governance
  4. A company must move 60 TB of archive data from its data center to Azure Blob Storage. The site has a 100 Mbps internet connection that is shared with production traffic, and… · Storage
  5. A company uses Azure File Sync with cloud tiering on file servers in the US and in India. Each morning, staff in India open project files that the US team created the previous… · Storage
  6. A team runs nightly rendering jobs on Azure Spot VMs to save money. Each VM keeps intermediate results on its OS disk. When Azure evicts a VM because it needs the capacity back… · Compute
  7. An ARM template deploys ten Windows Server VMs. As part of the same deployment, a PowerShell script stored in a blob container must run on every VM to install and configure IIS… · Compute
  8. A hub VNet contains a private DNS zone named privatelink.blob.core.windows.net. It has an A record for a storage account's private endpoint, and the zone is linked only to the… · Virtual Networking
  9. A company hosts a web site at one hostname behind one public IP address. Requests for /images/* must go to a pool of VMs optimized for static content, and requests for /api/*… · Virtual Networking
  10. An administrator must collect Windows event logs and Linux syslog from 50 VMs into a Log Analytics workspace. The collection settings, such as which event logs and which… · Monitoring & Backup

Test 7

Take Test 7 ›
  1. External partners are invited as guests to a project group, and they keep their access long after the project ends. The company wants the group owners to confirm every quarter… · Identity & Governance
  2. A team currently controls access to an Azure Key Vault with vault access policies. The security team now requires that access to individual secrets be granted through the same… · Identity & Governance
  3. A regulator requires that financial records stored as blobs cannot be modified or deleted by anyone, including storage account administrators, for seven years after they are… · Storage
  4. A security policy states that storage account access keys must not be usable to authorize requests to a storage account. The company's web application still needs to hand out… · Storage
  5. An administrator manages 200 Windows and Linux machines, some in Azure and some on-premises servers that are connected through Azure Arc. The company needs a view of missing… · Compute
  6. A web app on Azure App Service (Premium v3 plan) must call a database that has only a private IP address in a virtual network. The web app itself remains publicly reachable, and… · Compute
  7. An administrator wants a Log Analytics query that lists the machines that have stopped reporting. A machine is considered down if its most recent Heartbeat record is older than… · Monitoring & Backup
  8. A company must connect its data center to Azure VNets. Compliance requires that the traffic not cross the public internet, and the applications need consistent, predictable… · Virtual Networking
  9. A hub VNet has a VPN gateway with a site-to-site connection to the on-premises network. A spoke VNet is peered with the hub, and VMs in the spoke can reach VMs in the hub but not… · Virtual Networking
  10. A subscription contains about 100 Azure Monitor alert rules. Planned maintenance will run on Saturday from 22:00 to 02:00, and during that time the on-call team should not… · Monitoring & Backup

Test 8

Take Test 8 ›
  1. An Azure Policy assignment at the subscription level denies public IP addresses. One resource group must be allowed a public IP for a migration that ends in 30 days. Auditors… · Identity & Governance
  2. An administrator assigns a Microsoft 365 license to a Microsoft Entra security group and then adds 40 users to it. Thirty-six users receive the license, but four show a license… · Identity & Governance
  3. Container soft delete is enabled on a storage account with a 7-day retention period. Three days ago an engineer deleted a container that held several thousand blobs. The… · Storage
  4. The primary region of a GRS storage account has a prolonged outage. An administrator starts a customer-managed account failover so that the application can write again from the… · Storage
  5. Before deploying a Bicep file to a production resource group, an administrator wants a report of which resources will be created, modified or deleted, without changing anything… · Compute
  6. A web app runs on a Basic-tier App Service plan. The first request after a quiet period of about 20 minutes is very slow, while later requests are fast. The app is stateless and… · Compute
  7. A latency-sensitive application has an application tier and a database tier on separate virtual machines in one region. The two tiers exchange thousands of small requests per… · Compute
  8. Two hundred virtual machines in one subnet make many short outbound HTTPS connections to a single external API. Connections fail intermittently, and diagnostics show SNAT port… · Virtual Networking
  9. The apex name contoso.com must resolve to an Azure Traffic Manager profile that is hosted in Azure DNS. The administrator does not want to hard-code any IP address, because the… · Virtual Networking
  10. Security events in a Log Analytics table must be queryable interactively for 90 days. Compliance requires that they are kept for two years, and the cost should be as low as… · Monitoring & Backup

Test 9

Take Test 9 ›
  1. A user has the Reader role on a storage account. Running az storage blob list with --auth- mode login fails with an authorization error. The user must read blobs with Microsoft… · Identity & Governance
  2. An administrator moves a virtual machine from resource group RG-Dev to resource group RG- Prod in the same subscription. RG-Prod is located in a different region than the virtual… · Identity & Governance
  3. A storage account has its firewall set to Selected networks, and Azure Backup is used to protect a file share in it. Since the firewall was enabled, backup jobs fail with an… · Storage
  4. A company wants to encrypt a storage account with a customer-managed key kept in Azure Key Vault. Selecting the key from an existing vault fails with an error that says the vault… · Storage
  5. To cut costs, an administrator shuts down a virtual machine from inside its guest operating system. At the end of the month the compute charge for the virtual machine has not… · Compute
  6. An HTTP API runs in Azure Container Apps and is used only during business hours. The team wants to pay for compute only while requests arrive, and the app must scale out when… · Compute
  7. A deployment template needs the administrator password for a virtual machine. The password is stored as a secret in Azure Key Vault, and it must not appear in source control or… · Compute
  8. Remote employees must connect from their laptops to resources in an Azure virtual network. They should sign in with their Microsoft Entra accounts, and no on-premises VPN device… · Virtual Networking
  9. Virtual machines in a spoke network must reach only .microsoft.com over HTTPS. All other outbound internet traffic must be blocked, and the rule should be written by name, not by… · Virtual Networking
  10. A team wants Azure Backup to protect Azure managed disks and Azure Blobs in a subscription. An engineer proposes creating a Recovery Services vault for both. Which vault should… · Monitoring & Backup

Test 10

Take Test 10 ›
  1. A Global Administrator in Microsoft Entra ID cannot see any of the tenant's subscriptions in the portal. The administrator must be able to manage access on all subscriptions and… · Identity & Governance
  2. A resource group has the tag CostCenter=1234. A cost report filtered by that tag shows none of the resources inside the group. What is the reason, and how can it be fixed? · Identity & Governance
  3. A company wants to host a static site made of HTML, CSS and JavaScript from a storage account. The site must serve index.html at the root URL and show a custom error page for… · Storage
  4. A security review finds a blob container that allows anonymous read access. The company wants to make sure that no container in the storage account can serve blobs anonymously… · Storage
  5. A Windows virtual machine is unreachable over RDP after a guest firewall rule that blocks port 3389 was added. The network security group is correct. The administrator wants to… · Compute
  6. A web app on Azure App Service must let only users of the company's Microsoft Entra tenant in. The developers do not want to change the application code. What should the… · Compute
  7. A single Bicep deployment must create a new resource group and the resources inside it. Neither exists yet. How should the administrator deploy it? · Compute
  8. A web application is deployed in two regions. It needs TLS termination at the edge, a web application firewall, and failover that is not delayed by DNS caching on clients. Which… · Virtual Networking
  9. A virtual machine has a Standard SKU public IP address, and its network interface and subnet have no network security group. Connections to the machine on port 3389 from the… · Virtual Networking
  10. A metric alert on the request count of a web app uses a static threshold. Traffic follows daily and weekly patterns, so the alert fires falsely at peak hours and misses drops at… · Monitoring & Backup