Azure Administrator (AZ-104-aligned) Practice Exams

Three 50-question timed practice papers for the Azure administrator role: identity and governance, storage, compute, virtual networking, and monitoring and backup, weighted to the published AZ-104 skills outline.

3 practice papers · 150 questions · 100 minutes each · pass mark 70% · ₹196 for all papers

What the AZ-104 practice exams cover

Written from Microsoft's published AZ-104 study guide / skills measured outline.

Practice papers

Free AZ-104 sample questions

Sample question 1 (Identity and governance)

A new operations team member needs to create, start, stop, and resize virtual machines in a resource group, but must not be able to grant access to other users or manage networking resources outside of the VM scope. Which built-in Azure role should you assign at the resource group scope?

  1. Virtual Machine Contributor
  2. Contributor
  3. Owner
  4. Virtual Machine Administrator Login

Answer: A. Virtual Machine Contributor

Option A is correct because Virtual Machine Contributor grants permissions to create and manage virtual machines, including start, stop, and resize, without allowing access assignment or broad management of other resource types. Option B is incorrect because Contributor grants management rights over all resource types in the scope, including networking and storage, which exceeds the requirement. Option C is incorrect because Owner includes the ability to manage access assignments (Microsoft.Authorization/*/Write), which the scenario explicitly prohibits. Option D is incorrect because Virtual Machine Administrator Login only permits logging in to the OS of a VM, not managing its lifecycle or configuration in Azure.

Sample question 2 (Storage)

An external contractor needs temporary, time-limited, read-only access to a single block blob stored in a general-purpose v2 storage account. You must not share the storage account access key. What should you provide to the contractor?

  1. A stored access policy applied at the container level
  2. A shared access signature URI scoped to the blob with read permission and an expiry time
  3. The primary storage account access key
  4. A shared access signature URI scoped to the storage account with full permissions

Answer: B. A shared access signature URI scoped to the blob with read permission and an expiry time

A shared access signature URI scoped to the specific blob with read permission and an explicit expiry time grants temporary, least-privilege access without exposing the account key, so Option B is correct. Option A, a stored access policy, is a mechanism for managing SAS tokens but is not itself the access credential you hand to the contractor. Option C hands over the primary access key, which grants full control over the entire storage account and violates the requirement. Option D scopes the SAS to the entire storage account with full permissions, which is far broader than read-only access to one blob.

Sample question 3 (Compute)

A virtual machine scale set hosts a customer-facing web application. You need to configure autoscale so that one instance is added when the average CPU load across all scale set instances exceeds 75 percent for 10 minutes, and one instance is removed when average CPU falls below 30 percent for 15 minutes. Which metric should the autoscale rules reference?

  1. Memory percentage aggregated per instance
  2. Percentage CPU aggregated across the scale set
  3. Disk read operations per second aggregated across the scale set
  4. Network bytes in aggregated per instance

Answer: B. Percentage CPU aggregated across the scale set

Option B is correct because Percentage CPU is the built-in host metric that virtual machine scale sets expose for CPU-based autoscale rules, and it is aggregated as an average across the scale set. Option A is incorrect because memory percentage is a guest-level metric that is not available by default for scale set host monitoring. Option C is incorrect because disk read operations do not indicate compute pressure and are not suitable for scaling decisions. Option D is incorrect because network bytes in is a per-instance metric that does not reflect overall CPU load and is not the standard metric for this pattern.

Sample question 4 (Virtual networking)

You deploy three web servers and three database servers into the same virtual network. Each web server must be able to reach all three database servers over port 1433, but you want to avoid creating a separate network security group rule for every individual database server IP address. Which approach should you use?

  1. Create a single NSG rule that lists all database server private IP addresses in the destination address prefix
  2. Create an application security group for the database servers, assign each database server NIC to it, and use that ASG as the destination in an NSG rule
  3. Create a route table with a user defined route pointing to the database subnet and attach it to the web server subnet
  4. Create a private DNS zone named database.local and link it to the virtual network so the web servers can resolve database hostnames

Answer: B. Create an application security group for the database servers, assign each database server NIC to it, and use that ASG as the destination in an NSG rule

Option B is correct because an application security group lets you group VM network interfaces by workload role and reference that group as the source or destination in an NSG rule, so one rule covers all members. Option A would require a rule per IP address, which you explicitly want to avoid. Option C is used for traffic routing between subnets, not for grouping NICs for security rules. Option D enables private name resolution and does not simplify NSG rule management.

Sample question 5 (Monitoring and backup)

You create a Recovery Services vault in the East US region and enable backup for several Azure VMs. The default Enhanced policy is assigned, but your organization requires daily backups taken at 2:00 AM UTC with a retention period of 30 days for daily backups. What should you do to meet the requirement?

  1. Change the vault storage replication type from locally redundant to geo-redundant
  2. Create a custom backup policy in the vault with the required schedule and retention, then assign it to the VMs
  3. Configure a diagnostic setting on each VM to send metrics to a Log Analytics workspace
  4. Enable soft delete on the Recovery Services vault

Answer: B. Create a custom backup policy in the vault with the required schedule and retention, then assign it to the VMs

Option B is correct because you can create a custom backup policy in the Recovery Services vault that defines the daily schedule at 2:00 AM UTC and a 30-day daily retention, then assign that policy to the protected VMs. Option A changes how backup data is replicated across regions but does not control schedule or retention. Option C sends diagnostic and monitoring data to Log Analytics but does not configure backup frequency or retention. Option D protects backup data from accidental deletion but does not modify the backup schedule or retention period.

About these papers

Unofficial practice material. Every question is original, written from the vendor's publicly published exam objectives, and no real exam item is reproduced or paraphrased. This paper is not affiliated with, endorsed by, sponsored by or certified by the certification owner, and passing it does not confer any certification.

More certification practice exams