Practice Exam AZ-104: Azure Administrator Associate

Question bank: 100 · timed mock exam: 100 min

Official exam page on the vendor's site (opens in a new tab) Official exam guide (opens in a new tab) Official prep course (opens in a new tab)

Exam guide: format, domains and how to prepare

Compare: AZ-104 vs SAA-C03

Compare: AZ-104 vs AZ-305

Compare: AZ-104 vs AZ-700

Compare: AZ-140 vs AZ-104

Compare: AZ-802 vs AZ-104

  • Manage Azure identities and governance 24 questions
  • Deploy and manage Azure compute resources 24 questions
  • Implement and manage storage 20 questions
  • Implement and manage virtual networking 20 questions
  • Monitor and maintain Azure resources 12 questions
Study mode (free) Exam mode (subscribers)

Free: 25 questions in study mode, all domains, no account.

Subscription: the 100 questions of this certification, the timed exam mode, and all other certifications too.

Subscribe · €9.99 / month

Secure card payment (Stripe) · No commitment · Cancel online

How to prepare for Azure Administrator Associate (AZ-104) with InfraPrep

The 100 questions cover 5 domains: Manage Azure identities and governance, Deploy and manage Azure compute resources, Implement and manage storage, Implement and manage virtual networking, Monitor and maintain Azure resources. 25 of them are free, without an account.

Study mode

Answer at your pace: each answer is corrected straight away, with an explanation and the link to the documentation it relies on.

Exam mode

A timed exam of 100 minutes, with a question map to flag and come back to questions before you submit.

Results by domain

Your score is broken down by domain, so you know what to review first.

Original questions

Every question is written from the public documentation, never copied from the exam. You can contest an answer from study mode.

10 free sample questions

Question 1 Manage Azure identities and governance

An administrator at a company needs to invite a single external guest user into the Microsoft Entra tenant, and wants to use the least-privileged built-in Microsoft Entra role that is sufficient for just this task. Which role should be assigned?

  1. User Administrator
  2. Privileged Role Administrator
  3. Guest Inviter
  4. Global Administrator
Show the answer and the explanation

Correct answer: C

Microsoft's own least-privilege role table for user management lists the Guest Inviter role as the one required to invite an external guest.

Source: official documentation

Question 2 Implement and manage storage

A team needs to generate a shared access signature (SAS) to grant time-limited access to blobs, and wants to follow Microsoft's own security recommendation for which SAS type to use. Which type should they choose, and why?

  1. Service SAS, because it does not require any Microsoft Entra configuration
  2. Account SAS, because it is secured with the account key and is therefore simplest
  3. User delegation SAS — Microsoft's recommended, Entra-credential-secured option
  4. Any of the three types, because they all provide equivalent security guarantees
Show the answer and the explanation

Correct answer: C

The documentation states that Microsoft recommends using a user delegation SAS, and that it is secured with Microsoft Entra credentials instead of the account key, which is described as superior security.

Source: official documentation

Question 3 Deploy and manage Azure compute resources

During deployment, how does Azure actually process a Bicep file, and does this mean Bicep loses any capabilities compared to an ARM JSON template?

  1. Bicep replaces Resource Manager entirely, so JSON templates are no longer involved at deployment time
  2. The Bicep CLI compiles it into an ARM JSON template, with no loss of capability
  3. Bicep files must first be manually translated to JSON by the developer before every deployment
  4. Bicep files are deployed by a completely separate engine from ARM, so some resource types are ARM-only
Show the answer and the explanation

Correct answer: B

The documentation states that during deployment, the Bicep CLI converts a Bicep file into a Resource Manager JSON template, and describes Bicep as a transparent abstraction over a Resource Manager JSON template that doesn't lose the capabilities of a JSON template.

Source: official documentation

Question 4 Implement and manage virtual networking

VNet-Hub has its own VPN gateway. VNet-Spoke is peered with VNet-Hub and is configured to use VNet-Hub's gateway (a remote gateway) for its on-premises connectivity. According to the documentation, can VNet-Spoke also keep a VPN gateway of its own at the same time as using VNet-Hub's remote gateway?

  1. Yes — peered virtual networks can each use a local gateway and a remote gateway at the same time, without restriction
  2. No — gateway transit is not supported over virtual network peering at all
  3. Yes, but only if VNet-Hub and VNet-Spoke are in different Azure regions
  4. No — a virtual network can have only one gateway, and a virtual network using a remote gateway through peering can't have its own gateway at the same time
Show the answer and the explanation

Correct answer: D

The documentation states that a virtual network can have only one gateway, and that a virtual network using a remote gateway (through peering) can't have its own gateway at the same time — so VNet-Spoke, already using VNet-Hub's remote gateway, can't also keep its own.

Source: official documentation

Question 5 Monitor and maintain Azure resources

A team wants to write log queries against data collected in Azure Monitor Logs. Which query language should they learn, and what is it based on?

  1. A proprietary Azure Monitor scripting language unrelated to any other Microsoft product
  2. KQL — Azure Monitor Logs runs on Azure Data Explorer and its query language
  3. PromQL, because Azure Monitor Logs shares its engine with Azure Managed Prometheus
  4. Structured Query Language (SQL), because Azure Monitor Logs stores data in a relational schema
Show the answer and the explanation

Correct answer: B

The documentation states that Azure Monitor Logs is based on Azure Data Explorer and uses the same Kusto Query Language (KQL) to write log queries.

Source: official documentation

Question 6 Manage Azure identities and governance

An administrator tries to turn on the "Microsoft Entra roles can be assigned to the group" setting while creating a new group, so the group can later be used to assign Entra roles to its members. The tenant only has free Microsoft Entra licenses. What happens?

  1. The setting is available, but it silently downgrades the group to a distribution list
  2. The setting is available only after the group's membership type is changed to dynamic
  3. The setting is available but requires the Groups Administrator role instead of a license
  4. The setting cannot be enabled, because it requires a Microsoft Entra ID P1 or P2 license
Show the answer and the explanation

Correct answer: D

The documentation states that enabling role-assignable groups is only available with P1 or P2 licenses, so a tenant with only free licenses cannot turn it on.

Source: official documentation

Question 7 Implement and manage storage

A company wants Windows clients to access an Azure file share over SMB using identity-based authentication instead of a storage account key. Which authentication protocol does Azure Files use for this scenario?

  1. Kerberos
  2. NTLM
  3. OAuth 2.0 client credentials only
  4. SAML
Show the answer and the explanation

Correct answer: A

The documentation states that Azure Files supports identity-based authentication for Windows file shares over SMB using the Kerberos authentication protocol.

Source: official documentation

Question 8 Deploy and manage Azure compute resources

Among Azure's five managed disk types (Ultra Disk, Premium SSD v2, Premium SSD, Standard SSD, Standard HDD), which ones can be used as an OS disk?

  1. Only Ultra Disk and Premium SSD v2 — the other three cannot
  2. All five disk types can be used as an OS disk
  3. Only Ultra Disk, since it offers the highest performance
  4. Premium SSD, Standard SSD, and Standard HDD — the rest cannot
Show the answer and the explanation

Correct answer: D

Microsoft's comparison table lists, for the "usable as OS disk?" row across Ultra Disk, Premium SSD v2, Premium SSD, Standard SSD, and Standard HDD in that order: no, no, yes, yes, yes (the last one retiring in 2028) — so only Premium SSD, Standard SSD, and Standard HDD qualify.

Source: official documentation

Question 9 Implement and manage virtual networking

An NSG has an Allow rule at priority 200 and a Deny rule at priority 300 that both match the same inbound traffic to a subnet. A colleague argues the Deny rule wins because it is more restrictive. Based on how Azure evaluates NSG rules, is that correct?

  1. No — lower-priority-number rules win, and matching stops evaluation, so the priority-200 Allow applies
  2. Yes — more restrictive rules (Deny) always override more permissive ones (Allow), regardless of priority number
  3. No — both rules apply simultaneously, and Azure merges them into a partial-allow state
  4. Yes — priority 300 is evaluated first because Azure orders rules from highest to lowest number
Show the answer and the explanation

Correct answer: A

The documentation states that rules are processed in priority order, with lower numbers processed before higher numbers because lower numbers have higher priority, and that once traffic matches a rule, processing stops — so the priority-200 Allow rule matches first and the priority-300 Deny rule is never evaluated.

Source: official documentation

Question 10 Monitor and maintain Azure resources

A single alert rule's condition is applied to a resource group containing five VMs. Three of the VMs breach the condition at the same time. How many alerts fire, and how is the condition evaluated across the five VMs?

  1. The condition is evaluated separately for each resource, and alerts are fired for each resource separately — so three alerts fire, one per breaching VM
  2. No alert fires unless a majority (three or more) of the monitored resources breach the condition
  3. Exactly one alert fires regardless of how many resources breach the condition, merging all breaches into a single notification
  4. One combined alert fires only if all five VMs breach the condition simultaneously
Show the answer and the explanation

Correct answer: A

The documentation states that if you're monitoring more than one resource, the alert rule condition is evaluated separately for each of the resources, and alerts are fired for each resource separately — so each of the three breaching VMs triggers its own alert.

Source: official documentation

Frequently asked questions

Are there free questions, and do I need an account?

Yes. 25 questions of this certification are free in study mode, across all its domains, without a subscription and without registration. The account is created when you subscribe, at checkout.

How does the subscription work, and can I cancel?

One monthly subscription covers all certifications and the timed practice exams. There is no minimum period. You cancel online, at any time, with the "Cancel your contract" function in My account; cancellation takes effect at the end of the month already paid, and no further payment is taken.

Where do the questions come from?

Every question is original, written from the vendor's public documentation. Each answer comes with an explanation and a link to the documentation page it relies on. InfraPrep is not affiliated with the vendors, and certification names belong to their owners.

In which language are the questions?

The questions are written in English, also on the French version of the site.

Is the catalog updated?

Yes, the catalog changes over time: new certifications and new questions are added.