AZ-104 Practice Exam.
Free practice test — 40 verified questions, instant feedback.

Answer: A
Azure AD (Microsoft Entra ID) built-in directory roles like Helpdesk Administrator govern directory-level actions such as password resets and are separate from Azure RBAC, which governs access to Azure resources like subscriptions and resource groups. Owner and Contributor are Azure RBAC roles that control resource management, not directory user administration, and would grant far more (or unrelated) permissions than needed. A classic service administrator role is a legacy subscription-level construct unrelated to directory user management.

Answer: A
Azure Policy with a deny effect evaluates resource properties (like SKU) at creation and blocks non-compliant deployments, and assigning it at the management group scope applies it to all child subscriptions automatically. Blueprints orchestrate artifacts like policies and role assignments as a package but the enforcement mechanism for a SKU restriction is still a policy; assigning per-subscription is also less efficient than a management-group assignment. Resource locks only prevent deletion or modification of existing resources, not SKU selection at creation. A custom RBAC role can restrict who can create storage accounts but cannot enforce which SKU is chosen.

Answer: A
Contributor grants full read/write management of resources in scope but explicitly excludes the ability to modify role assignments, which matches the requirement. Owner includes everything Contributor has plus the ability to assign roles to other users, exceeding the requirement. Reader only allows viewing resources, not managing them. User Access Administrator manages role assignments but does not by itself grant broad resource management rights.

Answer: A
SSPR can be enabled for 'Selected' groups of users rather than all users, and even enabled users must register authentication methods (like phone or authenticator app) before they can use it, so an unregistered or out-of-scope user would be unable to reset their own password. SSPR works for both cloud-only and hybrid-synced accounts (with password writeback for hybrid). SSPR is a directory feature unrelated to Azure resource RBAC roles like Contributor. Global Administrators are not the only accounts eligible for SSPR; in fact restricting SSPR to only admins would defeat its self-service purpose.

Answer: B
A CanNotDelete lock prevents the resource from being deleted while still allowing read and write operations such as resizing disks or updating NIC settings. A ReadOnly lock would block the required configuration changes since it prevents all modifications, not just deletion. 'Contributor deny assignment' and 'Owner lock' are not actual Azure resource lock types; Azure only supports CanNotDelete and ReadOnly as lock levels.

Answer: A
Custom RBAC roles let administrators define a precise set of allowed and not-allowed actions (using Actions and NotActions), which is the correct mechanism to grant only start/restart while excluding stop, delete, and resize. Virtual Machine Contributor grants broad management including stop, delete, and resize, so relying on training does not technically enforce the restriction. Deny assignments are typically created by Azure (e.g., for managed apps) and are not a standard user-configurable mechanism for this scenario at the management group level in this way. Administrative units organize Azure AD objects like users and groups for delegated administration; they do not scope Azure resource-level action permissions on VMs.

Answer: A
The Activity log records subscription-level control-plane operations (create, update, delete, and their success or failure status) along with the caller identity, making it the correct source for an audit of who changed what. Azure AD sign-in logs show authentication events, not resource management operations. Network Watcher's topology view visualizes network resource relationships, not a change history. Azure Advisor provides best-practice recommendations, not an audit trail of actions taken.

Answer: A
Azure Monitor metric alert rules can evaluate a signal like CPU percentage against a threshold and, when triggered, invoke an action group that can send email notifications and call a Logic App, exactly matching the requirement. A saved search without a linked alert only stores a query for manual review and does not trigger automatic notifications. Azure Advisor cost recommendations address spending efficiency, not performance thresholds or automated remediation. Network Watcher's connection monitor tests network reachability, not CPU utilization.

Answer: A
A scheduled Start/Stop solution (via the dedicated feature or an Automation runbook) automatically deallocates VMs outside business hours, stopping compute billing during idle periods and restarting them for use, which precisely matches the need for automated, scheduled operation. Simply downsizing the VM does not address the fact that they run continuously and only need to run part of the day. Changing regions might offer marginal pricing differences but does not solve the core problem of paying for idle time. Spot pricing is designed for interruptible workloads that Azure can reclaim, and converting an existing running dev/test VM to Spot does not equate to scheduling its uptime and does not guarantee availability during required business hours.

Answer: A
The Azure Monitor Agent, deployed via data collection rules, gathers performance counters and event logs from both Azure and on-premises (Arc-enabled) machines and sends them to a Log Analytics workspace, where KQL queries can be run in Log Analytics. Storage Explorer is a tool for browsing blobs, files, queues, and tables, not for aggregating logs across servers. Network Watcher flow logs capture NSG traffic flow data, not general performance counters and event logs. A Recovery Services vault is used for backup and site recovery, not log collection and querying.

Answer: A
Azure Service Health tracks planned maintenance, service issues, and health advisories affecting a subscription's resources and region, while Resource Health shows the current and historical health of individual resources, matching the need to be alerted about upcoming maintenance and to review platform health history. Azure Policy's compliance dashboard reports on adherence to governance rules, not platform outages or maintenance. Cost Management + Billing tracks spending, not service health. Azure Migrate is used to assess and migrate on-premises workloads to Azure, unrelated to ongoing platform health notifications.

Answer: A
Sending diagnostic logs to a storage account is the most cost-effective option for long-term archival when logs are needed only occasionally for auditing rather than real-time analysis, and retention policies can be configured on the storage. Log Analytics workspaces provide powerful real-time querying but incur higher per-GB ingestion and retention costs, which is unnecessary if the logs are mainly for later compliance lookups. Sending to an Event Hub with no consumer just streams data without any retention or storage, so the logs would be lost. The Activity log captures control-plane subscription events and has its own fixed retention; it is not a destination for resource-level diagnostic logs like SQL Database query/audit logs.

Answer: A
ARM or Bicep templates provide declarative, idempotent, parameterized infrastructure-as-code that can be redeployed consistently across subscriptions or environments, exactly meeting the repeatability requirement. Manually creating VMs through the portal is error-prone and does not guarantee consistency, and documentation alone does not automate anything. Exporting a template once without reusing it wastes the main benefit of having a reusable template. Azure Advisor only offers recommendations for existing resources; it does not generate deployable infrastructure templates.

Answer: A
Virtual Machine Scale Sets natively support autoscaling based on metrics like CPU or custom metrics, automatically adding or removing VM instances behind a load balancer, matching the elasticity requirement. A single larger VM does not provide horizontal elasticity or high availability across multiple instances. An Availability Set groups VMs for fault domain/update domain distribution but does not itself provide autoscaling; the VM count is fixed unless manually changed. Azure Container Instances with a static count does not scale automatically and is a different compute model (containers, not VMs) that isn't described as needed here.

Answer: A
Shutting down the guest OS from within the VM stops the OS but does not release the underlying compute allocation; the VM remains in a 'Stopped' (allocated) state and continues to incur compute charges, unlike using 'Stop' (deallocate) from the Azure portal or CLI which releases the hardware allocation. Only stopping and deallocating (not just stopping) halts compute billing. Storage charges for the VM's disks apply regardless of power state, but that does not mean compute is automatically waived. Azure does not automatically deallocate a VM just because the guest OS was shut down from inside.

Answer: A
Changing a managed disk's storage tier/SKU (e.g., from Standard HDD to Premium SSD) typically requires the VM to be deallocated first, after which the SKU can be changed and the VM restarted, resulting in brief downtime but preserving the disk's data and identity. Some scenarios allow limited online changes, but the safe, generally applicable approach for this kind of tier change is to deallocate first. Deleting and recreating the VM and disk is unnecessarily destructive and risks data loss when a simple SKU change suffices. Attaching a new disk does not automatically migrate an OS or its data; OS migration between disks requires an explicit imaging or cloning process, not automatic OS relocation.

Answer: A
Azure Container Instances (ACI) offers a simple, serverless way to run individual containers on demand without provisioning or managing any underlying VMs or clusters, ideal for a simple periodic batch job. Azure Kubernetes Service is designed for orchestrating multiple containers with scaling, service discovery, and cluster management, which is unnecessary overhead for this simple single-run scenario. Running Docker manually on a Scale Set requires managing the VM infrastructure and container runtime yourself, adding operational burden not needed here. Service Fabric is a full microservices orchestration platform, again more complex than required for a simple daily batch job.

Answer: A
Availability Zones represent physically separate datacenters within a region, each with independent power, cooling, and networking; spreading VMs across two or more zones protects against a full datacenter-level failure, which an Availability Set (confined to a single datacenter's fault/update domains) cannot do. A single Availability Set only protects against rack-level (fault domain) or planned maintenance (update domain) failures within one datacenter, not a full datacenter outage. A single VM, regardless of disk type, has no redundancy against instance or datacenter failure. Deploying VMs in the same fault domain intentionally reduces redundancy rather than increasing it, which is the opposite of what's needed.

Answer: A
Generalizing (via sysprep on Windows or waagent deprovision on Linux) removes machine-specific information so that each VM created from the resulting image gets a fresh, unique identity, including computer name and administrator account set at provisioning time. If the source were not generalized (a 'specialized' image), the original computer name and settings would be retained, but that is not the case described. A generalized image is reusable to create many VMs, not limited to a single deployment. Generalized images can absolutely include pre-installed applications and configurations beyond just the base OS, which is one of the main benefits of custom images.

Answer: A
Azure Files provides fully managed SMB (and NFS) file shares that can be mounted concurrently from on-premises machines and Azure VMs without needing to run and maintain a file server VM. Blob Storage, even with public access, does not natively expose the SMB protocol for file-share-style mounting. Table Storage is a NoSQL key-value store, not a file share and has no SMB interface. Managed disks are block storage attached to a single VM at a time (or a few, with shared disks), not a general multi-client SMB file share.

Answer: A
The Archive access tier offers the lowest storage cost among blob tiers and is designed for data that is rarely accessed and can tolerate several hours of retrieval latency (rehydration), matching a 7-year compliance archive scenario. The Hot tier is optimized for frequently accessed data and has the highest storage cost, unsuitable for rarely accessed archives. The Cool tier is meant for infrequently accessed data still requiring rapid access (minutes, not hours) and costs more than Archive. The Premium block blob tier is optimized for high-performance, low-latency scenarios with higher cost, the opposite of what a low-cost long-term archive needs.

Answer: A
Time-based immutability policies enforce write-once-read-many (WORM) behavior at the container level, preventing modification or deletion of blobs for the configured retention period, which can be locked so that not even the account owner can shorten or remove it, matching legal/regulatory retention needs. A ReadOnly resource lock only prevents changes to the storage account's own configuration (like SKU or replication), not to blob content, and does not enforce immutability of the data. Soft delete protects against accidental deletion for a limited window but permanent deletion by an authorized user is still possible after that window (and during it) and it doesn't guarantee a fixed 5-year non-modifiable retention. Conditional access controls authentication conditions for sign-in, not data immutability within already-authorized sessions.

Answer: A
A SAS token can be scoped to specific resources, permissions (e.g., read-only), and a defined start/expiry time, allowing time-limited, granular access without exposing the full account key or requiring the third party to authenticate via Azure AD. Sharing the primary access key grants full account-level access to everything in the storage account, far exceeding the least-privilege need, and manually rotating it is an operationally risky workaround. An Azure AD app registration would still require the third party to be able to authenticate against Azure AD, which the requirement explicitly rules out. Enabling public container access exposes the data to anyone on the internet, not just the intended third party, and toggling it manually is error-prone and not scoped to specific permissions or blobs.

Answer: A
GRS/GZRS replicates data asynchronously to a secondary, geographically distant region, and enabling account failover (or RA-GRS/RA-GZRS for read access) allows the storage account to continue serving requests if the primary region fails. LRS only replicates within a single datacenter, offering no protection against a regional or even datacenter-level outage. ZRS replicates synchronously across availability zones within a single region, protecting against datacenter failure but not a full regional outage. Relying solely on manual backups does not provide automatic failover or continuous availability during a regional outage; it would require manual restoration, causing extended downtime.

Answer: A
Azure File Sync centralizes file shares in Azure Files while keeping a cache of frequently used files on the on-premises server (cloud tiering) and provides multi-directional sync between the server endpoint and the cloud endpoint, matching the requirement exactly. AzCopy scheduled one-way only copies data in a single direction and does not provide caching or bidirectional sync. Azure Data Box is intended for one-time bulk data transfer via physical shipped devices, not ongoing bidirectional synchronization. The Azure Import/Export service similarly supports one-time bulk data movement using disks shipped to a datacenter, not continuous sync with local caching.

Answer: A
Azure automatically creates default system routes that enable direct communication between all subnets within the same virtual network, so without any NSG rules blocking it or custom routes overriding it, VMs in different subnets of the same VNet can reach each other. 'Peering' is a concept for connecting two separate VNets, not subnets within the same VNet, so no peering is needed here. A VPN gateway is used for connecting to on-premises networks or other VNets over encrypted tunnels, not for intra-VNet subnet communication. Availability Zones are a compute/infrastructure resiliency concept unrelated to whether subnets within a VNet can route to each other.

Answer: A
When NSGs exist at both subnet and NIC level, traffic must be allowed by both NSGs to pass; each NSG evaluates its own rules by priority order (lowest number first), and if either NSG has an explicit deny that applies (and no higher-priority allow overrides it within that same NSG), the traffic is blocked overall — so the actual outcome depends on each NSG's own rule priorities, not a blanket 'NIC always wins' or 'subnet always wins' rule. Neither NIC-level nor subnet-level NSGs automatically and entirely override the other; both are evaluated independently and traffic must pass both. Azure fully supports applying NSGs at both subnet and NIC levels simultaneously.

Answer: A
Global VNet peering connects VNets across regions using the Microsoft backbone network, enabling low-latency private IP communication without traversing the public internet, which is exactly what's needed here. A site-to-site VPN, while it can connect networks, typically uses IPsec tunnels over the public internet (or ExpressRoute) and is more commonly used for on-premises-to-Azure connectivity, adding unnecessary encryption/tunneling overhead compared to native peering for VNet-to-VNet in the same cloud. NAT gateways provide outbound internet connectivity for private resources; they do not establish private connectivity between two VNets. Assigning public IPs to VMs and exposing them via NSG rules routes traffic over the public internet and increases the attack surface, which conflicts with the requirement to avoid the public internet.

Answer: A
Network Watcher provides diagnostic tools such as IP flow verify (to check whether specific traffic is allowed or denied by NSG rules) and connection troubleshoot (to test connectivity and identify where a connection fails, including latency and hops), directly addressing suspected health probe or connectivity misconfigurations. Cost Management analyzes spending and has no role in network diagnostics. Identity Protection risk reports relate to user sign-in risk detection, unrelated to VM network connectivity. Azure Backup's restore point browser is for recovering backed-up data, not diagnosing live network issues.

Answer: A
Application Gateway operates at Layer 7 (HTTP/HTTPS) and supports path-based routing rules to direct requests to different backend pools based on URL path, as well as centralized SSL/TLS termination, matching all stated requirements. A standard Load Balancer operates at Layer 4 and distributes traffic based on IP/port, without awareness of HTTP paths or built-in SSL termination for path routing. ExpressRoute provides private dedicated connectivity between on-premises networks and Azure; it does not perform application-layer load balancing or path-based routing. An NSG filters traffic based on IP/port/protocol rules and has no concept of URL paths or SSL termination.

Answer: A
Historically, Azure provides a default outbound access IP for VMs that don't have an explicit outbound connectivity method (public IP, NAT gateway, or load balancer outbound rules) configured, allowing outbound internet connectivity, although Microsoft recommends explicit methods like a NAT gateway for reliability and to avoid this implicit, less-visible mechanism going forward. Outbound access is possible even without a public IP or NAT gateway due to this default mechanism, though it is not considered a best practice for production. A VPN gateway is unrelated to general internet-bound (as opposed to on-premises-bound) traffic. A managed identity is used for authenticating to Azure AD-secured services, and has no bearing on whether a VM has outbound internet connectivity.

Answer: A
Peering being 'Connected' only establishes the network-layer reachability path between VNets; NSGs applied to subnets or NICs, or user-defined routes that redirect or block traffic, can still prevent communication and must be checked separately. VNets with overlapping (identical or overlapping) address spaces actually cannot be peered successfully at all — non-overlapping address spaces are a prerequisite for peering to succeed, not a cause of connectivity failure after peering is already established. VM size has no bearing on network connectivity between peered VNets. The creation date of VMs is irrelevant to network connectivity.

Answer: A
Azure Private DNS zones allow custom domain names to be resolved within linked virtual networks without exposing those records to the public internet, and the same zone can be linked to multiple VNets for consistent internal name resolution. The default Azure-provided DNS only resolves Azure-internal hostnames automatically assigned to resources; it does not support custom private domain names like corp.internal. Public DNS zones are designed for internet-facing name resolution; there isn't a 'private visibility' toggle that turns a public zone into an internal-only one — that is what Private DNS zones are for. Simply opening port 53 outbound via an NSG rule does not create or host any DNS records; it only permits DNS traffic to flow, which is unrelated to actually defining the custom names.

Answer: A
Best practice for break-glass (emergency access) accounts is to explicitly exclude them from Conditional Access policies that could lock out administrators (like MFA requirements that might fail during an identity provider outage), while securing them with strong, unique, closely monitored credentials, ensuring they remain usable during an emergency. Simply granting Global Administrator without excluding it from the policy would still let the MFA-requiring policy apply and potentially cause lockout during the exact incident the account is meant to resolve. Placing it in the same group as regular users defeats its purpose as an exception path. A shared password known to multiple people is a poor security practice that increases risk of compromise and undermines accountability, even for an emergency account.

Answer: A
Azure RBAC role assignments are additive across scopes: permissions granted at a higher scope (subscription) are inherited by lower scopes (resource groups), and additional roles assigned directly at a lower scope add further permissions, so the user effectively has the union of Reader (from the subscription) and Contributor (from the resource group) — and since Contributor's permissions are a superset relevant to that resource group, the effective permission there is Contributor. RBAC does not have the subscription scope 'override' or take precedence over a more specific, additional assignment at a narrower scope. Conflicting Azure RBAC assignments don't cancel out; they combine (unlike deny assignments, which do override allow assignments, but that's not what's described here). There's no session-based 'role activation' choice for standard RBAC role assignments (that concept applies to PIM eligible role activation, not to two permanently active assignments as described).

Answer: A
Privileged Identity Management enables 'eligible' role assignments that users must actively activate, optionally requiring approval, justification, and MFA, with the elevated access automatically expiring after a configured duration, directly matching the just-in-time requirement. A permanent standing role assignment, even if periodically reviewed, keeps the user privileged at all times, which is the opposite of just-in-time, time-limited access. A conditional access device-compliance policy controls sign-in conditions but does not implement time-bound role activation or approval workflows for elevation. Dynamic groups automatically add/remove members based on attributes but do not provide time-limited, approval-gated privilege elevation.

Answer: A
Assigning the built-in 'allowed locations' policy at the root or a top-level management group ensures it is automatically inherited by all subscriptions currently under it and any new ones added later, minimizing ongoing manual work while enforcing the restriction tenant-wide. Manually assigning the policy per subscription requires repeated effort every time a new subscription is created and risks being forgotten. Azure AD user profile regional preferences have no effect on Azure resource deployment location restrictions. Azure Advisor only provides after-the-fact recommendations; it does not prevent resource creation in disallowed regions, so it fails the 'prevent' requirement.

Answer: A
The AZ-104 score report provides a numeric score for overall performance, a pass/fail status, and a bar chart showing performance in each skill area assessed, giving candidates both a summary result and a breakdown of relative strengths and weaknesses. It is not just a bare pass/fail result — it includes the numeric score and skill-area breakdown. It is not reported as a worldwide percentile ranking. Exam security policies prevent disclosure of specific questions and correct answers on the score report, since exam content is confidential and reused across administrations.

Answer: A
Candidates have 100 minutes to complete Exam AZ-104, and there is no penalty for guessing since no points are deducted for incorrect answers, meaning candidates should attempt every question rather than leave any blank. 150 minutes overstates the actual allotted time. There is no point-deduction penalty for wrong answers, so any answer choice claiming guesses are penalized is incorrect. 60 minutes understates the actual allotted time for the standard exam.

Answer: A
A score of 700 or greater on the 1,000-point scale is required to pass, and this role-based certification has a 12-month renewal frequency with a free, shorter, unproctored, open-book renewal assessment available within a six-month window before expiration. A passing score of 500 understates the actual threshold, and the certification does expire, requiring periodic renewal rather than being permanent. 700 is correct, but renewal is explicitly shorter, unproctored, and free — not a repeat of the full original proctored exam with its fee. 800 overstates the passing threshold, and renewal is unproctored, not conducted at a testing center.