How are AZ-104 questions generated?

dotCreds builds AZ-104 practice questions from public exam objectives and Microsoft Learn and exam-objective references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

The site is the fastest way to start AZ-104 practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

Why use the app when available?

The web page is the quick daily practice layer. If a dotCreds app is available for AZ-104, the app is better for larger banks, focused weak-domain drills, longer review sessions, and mobile study routines.

Free AZ-104 Practice Test (2026) - Azure Administrator Questions

AZ-104 Practice Test

Work through a fresh 10-question AZ-104 set every day from the same verified live bank used by the app, with exact source links and a countdown to the next rotation.

10 Free Daily Questions Source-backed Explanations 150 Verified Questions

Questions updated at Jul 10, 2026, 12:01 AM CDT

Guided Course Included Learn AZ-104 step by step. Structured lessons, progress tracking, practice questions, and per-exam Course Notes covering every section in this bank.

Step-by-step lessons Per-exam Course Notes All sections included Practice tied to the same bank

Start AZ-104 Guided Course Course Notes

Unlock the full AZ-104 bank

150 verified exam-style questions $4.99 one-time No subscription Secure checkout Instant unlock

Get the complete source-backed bank with correct-answer explanations, distractor breakdowns, saved review, full Course Mode, and per-exam Course Notes.

Course Mode + Course Notes included • Instant unlock • No subscription

Exam Mode Practice Mode Course Mode Course Notes Weak-area review Previous scores Source links Every choice explained No ads

Question 1 of 10

Objective 1.2 Manage Azure identities and governance

Two administrators need access to the same subscription. One will manage only virtual machines, and the other will manage only virtual networks. You need to assign built-in Azure RBAC roles using least privilege. What should you assign?

Concept tested: Manage Azure identities and governance (1.2)

Source:Azure role-based access control overview

Question 2 of 10

Objective 3.1 Deploy and manage Azure compute resources

Within a Bicep file, which keyword is essential for declaring an Azure storage account to be deployed as part of the ARM template?

Concept tested: Deploy and manage Azure compute resources (3.1)

Question 3 of 10

Objective 2.2 Implement and manage storage

During a regional outage, your disaster recovery plan mandates that applications continue to access data from a secondary region. Which Azure Storage redundancy option provides read access to data in the secondary region?

Concept tested: Implement and manage storage (2.2)

Question 4 of 10

Objective 1.3 Manage Azure identities and governance

A critical resource can still be updated, but administrators must be prevented from deleting it accidentally. Which lock should you apply?

Concept tested: Manage Azure identities and governance (1.3)

Question 5 of 10

Objective 3.1 Deploy and manage Azure compute resources

You are creating a Bicep module and want the default location for the deployed Azure resources to match the location of the target resource group. Which parameter declaration is the most efficient approach?

Concept tested: Deploy and manage Azure compute resources (3.1)

Question 6 of 10

Objective 2.1 Implement and manage storage

You need a service SAS whose start time, expiry time, and permissions can be managed centrally after the SAS is issued. What should you use?

Concept tested: Implement and manage storage (2.1)

Question 7 of 10

Objective 1.1 Manage Azure identities and governance

Users reset their passwords in Microsoft Entra ID, and the organization needs those password changes written back to the on-premises directory. What should be configured?

Concept tested: Manage Azure identities and governance (1.1)

Question 8 of 10

Objective 2.3 Implement and manage storage

A storage account contains blobs that are frequently accessed for 30 days and then rarely read. You need to reduce storage costs automatically as the data ages. What should you configure?

Concept tested: Implement and manage storage (2.3)

Question 9 of 10

Objective 1.2 Manage Azure identities and governance

A contractor only needs access to resources in one resource group for a migration project. At which scope should you assign the role?

Concept tested: Manage Azure identities and governance (1.2)

Question 10 of 10

Objective 2.1 Implement and manage storage

A storage account firewall needs to allow traffic only from specific subnets within an Azure virtual network. Which firewall rule type should be configured to achieve this?

Concept tested: Implement and manage storage (2.1)

Unlock the full AZ-104 bank. No ads.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

150 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 140 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

No ads

Question 1 Two administrators need access to the same subscription. One will manage only virtual machines, and the other will manage only virtual networks. You need to assign built-in Azure RBAC roles using least privilege. What should you assign?

Answer choices

A. Create a custom role that combines VM management and network management permissions
B. Enable Azure AD roles for each user based on their responsibilities
C. Grant both users the 'Owner' role for their respective resource groups
D. Assign the 'Virtual Machine Contributor' role to the first user and the 'Network Contributor' role to the second user

Correct answer

Assign the 'Virtual Machine Contributor' role to the first user and the 'Network Contributor' role to the second user

Azure RBAC provides built-in roles for common resource duties. Virtual Machine Contributor and Network Contributor separate VM administration from virtual network administration without granting broad Owner permissions or unrelated directory roles.

Wrong-answer review

A. Create a custom role that combines VM management and network management permissions: A custom role is useful for unusual permission sets, but built-in VM and network roles already match these duties.
B. Enable Azure AD roles for each user based on their responsibilities: Microsoft Entra directory roles administer identity resources; they do not grant Azure resource management rights for VMs and virtual networks.
C. Grant both users the 'Owner' role for their respective resource groups: Owner grants broad management and role-assignment rights, which exceeds the limited VM and network duties.

Objective/domain: Manage Azure identities and governance (1.2)

Question 2 Within a Bicep file, which keyword is essential for declaring an Azure storage account to be deployed as part of the ARM template?

A. resource
B. param
C. property
D. variable

resource

Objective/domain: Deploy and manage Azure compute resources (3.1)

Source: What is Bicep?

Question 3 During a regional outage, your disaster recovery plan mandates that applications continue to access data from a secondary region. Which Azure Storage redundancy option provides read access to data in the secondary region?

A. Zone-redundant storage (ZRS)
B. Geo-redundant storage without read access enabled
C. Locally-redundant storage (LRS)
D. Geo-redundant storage with read-access (GRS or GZRS)

Geo-redundant storage with read-access (GRS or GZRS)

Objective/domain: Implement and manage storage (2.2)

Source: Azure Storage redundancy

Question 4 A critical resource can still be updated, but administrators must be prevented from deleting it accidentally. Which lock should you apply?

A. Read-Only Lock
B. Delete Lock
C. Tag Lock
D. Access Lock

Delete Lock

Objective/domain: Manage Azure identities and governance (1.3)

Source: Lock resources to prevent changes

Question 5 You are creating a Bicep module and want the default location for the deployed Azure resources to match the location of the target resource group. Which parameter declaration is the most efficient approach?

A. resource location string = 'eastus'
B. variable location = 'eastus'
C. output location string = 'eastus'
D. param location string = resourceGroup().location

param location string = resourceGroup().location

Question 6 You need a service SAS whose start time, expiry time, and permissions can be managed centrally after the SAS is issued. What should you use?

A. Stored access policy
B. User delegation key
C. Storage account firewall rule
D. Private DNS zone delegation

Stored access policy

Objective/domain: Implement and manage storage (2.1)

Source: Define a stored access policy

Question 7 Users reset their passwords in Microsoft Entra ID, and the organization needs those password changes written back to the on-premises directory. What should be configured?

A. Conditional access policies
B. SSPR writeback
C. Azure AD Connect
D. Multi-factor authentication (MFA)

SSPR writeback

Objective/domain: Manage Azure identities and governance (1.1)

Source: How Microsoft Entra self-service password reset works

Question 8 A storage account contains blobs that are frequently accessed for 30 days and then rarely read. You need to reduce storage costs automatically as the data ages. What should you configure?

A. Assign a route table
B. Tier blobs to cool or archive
C. Create a private endpoint
D. Enable shared key access

Tier blobs to cool or archive

Objective/domain: Implement and manage storage (2.3)

Source: Azure Blob Storage lifecycle management

Question 9 A contractor only needs access to resources in one resource group for a migration project. At which scope should you assign the role?

A. Every subscription
B. The resource group
C. The management group
D. The tenant root

The resource group

Source: Assign Azure roles using the Azure portal

Question 10 A storage account firewall needs to allow traffic only from specific subnets within an Azure virtual network. Which firewall rule type should be configured to achieve this?

A. Resource instance rules
B. IP network rules
C. Virtual network rules
D. Trusted service exceptions

Virtual network rules

Source: Configure Azure Storage firewalls and virtual networks

AZ-104 Practice Test

AZ-104

Why this page works

Unlock the full AZ-104 bank

Practice with explanations that teach.

Two administrators need access to the same subscription. One will manage only virtual machines, and the other will manage only virtual networks. You need to assign built-in Azure RBAC roles using least privilege. What should you assign?

Within a Bicep file, which keyword is essential for declaring an Azure storage account to be deployed as part of the ARM template?

During a regional outage, your disaster recovery plan mandates that applications continue to access data from a secondary region. Which Azure Storage redundancy option provides read access to data in the secondary region?

A critical resource can still be updated, but administrators must be prevented from deleting it accidentally. Which lock should you apply?

You are creating a Bicep module and want the default location for the deployed Azure resources to match the location of the target resource group. Which parameter declaration is the most efficient approach?

You need a service SAS whose start time, expiry time, and permissions can be managed centrally after the SAS is issued. What should you use?

Users reset their passwords in Microsoft Entra ID, and the organization needs those password changes written back to the on-premises directory. What should be configured?

A storage account contains blobs that are frequently accessed for 30 days and then rarely read. You need to reduce storage costs automatically as the data ages. What should you configure?

A contractor only needs access to resources in one resource group for a migration project. At which scope should you assign the role?

A storage account firewall needs to allow traffic only from specific subnets within an Azure virtual network. Which firewall rule type should be configured to achieve this?

You are viewing today’s free 10. Unlock 140 more questions.

Build your practice session

Set your target once.

Customize your session

Unlock the full AZ-104 bank. No ads.

7-day score keeper

Keep today’s practice moving

Answer choices

Correct answer

Wrong-answer review

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

Answer choices

Correct answer

How are AZ-104 questions generated?

How are explanations sourced?

What score do I get?

Why use this site?

Why use the app when available?