Skip to questions
Pass104

10 Free AZ-104 Practice Questions with Explanations

Practise Azure administration with 10 sample questions covering identity, storage, compute, networking and monitoring. Try each question, then review the answer and explanation. No account required.

Start with question 1
Work through the set

Four choices per question. Think through your answer, then open the explanation to check it.

10 questions · 5 domains · no timer

Identity and governance

Questions 1–2
Question 1 of 10Azure RBAC

You have an Azure subscription named Sub1 with a resource group named RG1. User1 must be able to create, modify, and delete all types of resources in RG1, but must not be able to grant other users access to RG1. What is the minimum role you should assign to User1 at the RG1 scope?

  1. Owner
  2. Contributor
  3. User Access Administrator
  4. Reader
Show answer and explanation

Correct answer: B · Contributor

Contributor can manage resources at the assigned scope but cannot assign Azure RBAC roles. Assigning it at RG1 gives User1 the required resource management access without access delegation.

Why the other choices do not fit

  • A. Owner can manage resources, but can also assign roles. That violates the access restriction.
  • C. User Access Administrator manages user access; it does not grant the required general resource management permissions.
  • D. Reader can view resources but cannot create, change, or delete them.
Microsoft LearnAzure built-in roles
Question 2 of 10Azure Policy

Your company has 25 custom Azure Policy definitions for tagging and naming. You need to apply all 25 to 12 subscriptions and manage them as one item at each scope. Which Azure Policy resource should you use?

  1. An initiative
  2. An assignment
  3. An exemption
  4. A remediation task
Show answer and explanation

Correct answer: A · An initiative

An initiative groups policy definitions as one policy set. You can assign that initiative to each subscription and manage the collection together.

Why the other choices do not fit

  • B. An assignment applies a definition or an initiative to a scope. By itself, it does not group the 25 definitions.
  • C. An exemption excludes a scope from a policy assignment; it does not package definitions for deployment.
  • D. A remediation task brings existing noncompliant resources into compliance for certain effects. It does not group policy definitions.
Microsoft LearnAzure Policy overview

Storage

Questions 3–4
Question 3 of 10Azure Files

Several Azure virtual machines must mount the same migrated file share over SMB and read and write the same files at the same time. Which Azure storage service should you use?

  1. Azure Blob Storage
  2. Azure Files
  3. Azure Queue Storage
  4. Azure Table Storage
Show answer and explanation

Correct answer: B · Azure Files

Azure Files provides managed SMB file shares that multiple clients can mount concurrently. It matches the existing shared file system access pattern.

Why the other choices do not fit

  • A. Blob Storage stores objects and does not provide an SMB-mounted file share.
  • C. Queue Storage holds messages for asynchronous processing, not shared files.
  • D. Table Storage holds schemaless structured entities, not an SMB file system.
Microsoft LearnSMB Azure file shares
Question 4 of 10Shared access signatures

An external vendor needs read access to the images in one blob container for 48 hours. The vendor has no identity in your Microsoft Entra tenant. You must not share the storage account key. What should you do?

  1. Generate a service SAS for the images container with read permission and a 48-hour expiry
  2. Assign the Storage Blob Data Reader role to the vendor
  3. Give the vendor a storage account connection string
  4. Enable anonymous public read access on the container
Show answer and explanation

Correct answer: A · Generate a service SAS for the images container with read permission and a 48-hour expiry

A container-scoped service SAS can carry read permission and an expiry time. The vendor receives the SAS URI, not the account key. Treat the SAS itself as a secret until it expires.

Why the other choices do not fit

  • B. An RBAC role needs an identity that can receive a role assignment; the scenario says the vendor has none in this tenant. It also does not impose a 48-hour expiry by itself.
  • C. A connection string typically contains an account key, exposing broad account access and breaking the stated constraint.
  • D. Anonymous read allows anyone with the URL to access the images and does not expire after 48 hours.
Microsoft LearnShared access signatures overview Create a service SAS

Compute

Questions 5–6
Question 5 of 10Virtual machine costs

VM1 runs a development workload used only from 08:00 to 18:00 on weekdays. You need to stop compute charges outside working hours with minimal daily administration. What should you configure?

  1. Auto-shutdown for VM1
  2. A daily shutdown inside the guest operating system
  3. A daily resize to a smaller VM size
  4. Azure Hybrid Benefit
Show answer and explanation

Correct answer: A · Auto-shutdown for VM1

Azure VM auto-shutdown schedules a control-plane shutdown and deallocation. A deallocated VM no longer incurs VM compute charges. Configure the correct time zone and arrange startup when the team needs it.

Why the other choices do not fit

  • B. Shutting down from within the guest can leave the VM allocated, so compute charges continue.
  • C. A smaller running VM still incurs compute charges.
  • D. Azure Hybrid Benefit can reduce eligible licensing cost; it does not stop VM compute billing.
Microsoft LearnAuto-shutdown an Azure VM VM states and billing

Want more practice?

Create a free Pass104 account for one daily 6-question practice exam, explanations and progress tracking. No card required.

Start practising free
Question 6 of 10App Service deployment slots

A web app runs on a Basic B1 App Service plan. You need to add a staging deployment slot while keeping the plan at the lowest tier that supports slots. What should you do first?

  1. Scale up to Standard S1
  2. Scale up to Premium P1v3
  3. Scale up to Basic B3
  4. Scale out to three instances
Show answer and explanation

Correct answer: A · Scale up to Standard S1

Deployment slots are available from the Standard tier upward. Standard S1 is the first listed option that enables a staging slot.

Why the other choices do not fit

  • B. Premium supports slots, but it is a higher tier than required.
  • C. Basic B3 increases the Basic plan size; Basic still does not support deployment slots.
  • D. Adding instances changes capacity, not the feature set of the Basic tier.
Microsoft LearnApp Service deployment slots

Networking

Questions 7–8
Question 7 of 10Virtual network peering

VNet1 is peered with VNet2, and VNet2 is peered with VNet3. VMs in VNet1 cannot reach VMs in VNet3. You want connectivity without deploying an appliance or gateway. What should you do?

  1. Create a peering between VNet1 and VNet3
  2. Enable Allow forwarded traffic on VNet2’s peerings
  3. Enable Allow gateway transit on VNet2’s peerings
  4. Add a route in VNet1 to VNet3 with next hop Virtual network
Show answer and explanation

Correct answer: A · Create a peering between VNet1 and VNet3

VNet peering is not transitive. The two existing peerings do not form a VNet1-to-VNet3 connection, so a direct peering supplies the missing link without another resource.

Why the other choices do not fit

  • B. Allow forwarded traffic permits traffic forwarded by a device, but the scenario has no forwarding appliance and the setting does not make peering transitive.
  • C. Gateway transit shares a virtual network gateway, not direct reachability through a second peering.
  • D. A route alone does not create a peering or another forwarding path between the VNets.
Microsoft LearnVirtual networks and subnets
Question 8 of 10Network Watcher

Users cannot connect to VM1 over RDP on TCP port 3389 from a known public IP address. Several network security groups contain dozens of rules. Which Network Watcher tool tells you whether this specific inbound packet is allowed or denied and identifies the responsible rule?

  1. Effective security rules
  2. IP flow verify
  3. Next hop
  4. Connection monitor
Show answer and explanation

Correct answer: B · IP flow verify

IP flow verify evaluates the supplied direction, protocol, addresses, and ports against the effective network security rules. Its result includes Allow or Deny and the rule responsible.

Why the other choices do not fit

  • A. Effective security rules lists the combined rules on a network interface, but does not evaluate this particular packet for you.
  • C. Next hop checks routing, not which security rule allows or denies an RDP packet.
  • D. Connection monitor tracks connectivity over time; it is not the direct rule-by-rule packet verdict requested.
Microsoft LearnDiagnose VM traffic filtering

Monitoring and backup

Questions 9–10
Question 9 of 10Azure Backup

An on-premises Windows Server file server needs its files, folders, and system state backed up to Azure with a three-year retention policy. You must not deploy a separate backup server or provision backup storage. What should you use?

  1. Install the MARS agent on the server and register it with a Recovery Services vault
  2. Deploy Microsoft Azure Backup Server on premises
  3. Replicate the server with Azure Site Recovery
  4. Enable Azure File Sync with cloud tiering
Show answer and explanation

Correct answer: A · Install the MARS agent on the server and register it with a Recovery Services vault

The Microsoft Azure Recovery Services (MARS) agent backs up files, folders, and Windows Server system state directly to a Recovery Services vault. Its retention policy can include yearly recovery points, without a separate backup server.

Why the other choices do not fit

  • B. Microsoft Azure Backup Server can protect the workload, but requires deploying and maintaining a backup server and local storage.
  • C. Azure Site Recovery replicates machines for disaster recovery; it is not this file, folder, and system-state backup policy.
  • D. Azure File Sync synchronizes a file share and can tier files. Synchronization does not provide the requested system-state backups and retention policy.
Microsoft LearnAzure Backup architecture Back up Windows system state Backup retention policies
Question 10 of 10Azure Monitor

Azure Monitor Agent on a Windows VM collects processor and memory performance counters. You also need the Windows Security event log. Which single destination lets you store and query both data types together?

  1. An Azure Monitor Metrics database
  2. A Log Analytics workspace
  3. The storage account used by boot diagnostics
  4. An Azure Event Hubs namespace
Show answer and explanation

Correct answer: B · A Log Analytics workspace

A data collection rule can send performance counters and Windows Security events to the same Log Analytics workspace. There, the Perf and Event tables can be queried together with KQL.

Why the other choices do not fit

  • A. Azure Monitor Metrics stores numeric metrics, not Windows Security event records.
  • C. Boot diagnostics storage holds boot logs and screenshots, not the combined agent data required here.
  • D. Event Hubs streams events to consumers; it is not the queryable Log Analytics store for both sources.
Microsoft LearnCollect performance counters Collect Windows events

Keep practising beyond these 10

Create a free Pass104 account for one daily 6-question practice exam, explanations and progress tracking. No card required.

Start practising free

These are practice questions, not actual exam questions. The selected answers and explanations were checked against the linked Microsoft Learn documentation on 25 September 2026. Azure services and exam objectives can change, so use the references for the latest details. Pass104 is independent of Microsoft.