Are these real AZ-104 exam questions?

No — and you should be wary of any site that says its questions are. Real exam items are confidential, and studying leaked ones ("brain dumps") violates the Microsoft Azure certification agreement and can get your certification revoked. These questions are written from scratch against the published AZ-104 exam guide to match its style, difficulty and domain weighting.

Do the AZ-104 questions come with explanations?

Every option carries its own explanation — not just the correct one. You find out why the answer you nearly picked was wrong, which is where most of the learning actually happens. Each question also links back to the revision lesson that teaches the concept.

How many practice questions should I do before the AZ-104 exam?

Volume matters less than what you do with the misses. A useful signal is consistency rather than a total: when you can hold a comfortable margin above the 700 pass mark on questions you have never seen before, across every domain rather than just your strong ones, you are ready.

Can I retry the questions I got wrong?

Yes. Wrong answers and flagged questions go into a review pool you can drill on their own, so you can grind exactly the material that is costing you marks instead of re-answering the ones you already know.

AZ-104 practice

Free AZ-104 practice questions

Drill exam-realistic Microsoft Certified: Azure Administrator Associate questions by domain, with an explanation on every option — not just the right one. 5 fully worked examples are further down this page, answers included.

Question bank: 300
across 5 domains
Free, no account: 5/day
sign up free to remove the cap
Real exam: 50 Qs
100 min · pass 700
Explanations: Every option
right and wrong

Build a practice session

Domains

How many?

Mode

Ready when you are

10 fresh questions drawn across all domains, in Learn mode.

Focused review

Every question you answer incorrectly, and every question you flag while practising, is saved here automatically. Finish a session and you can come back to re-drill just those.

5 sample AZ-104 questions, fully explained

Real questions from the AZ-104 bank, with the answer key and the reasoning behind every option. Read them, then go back up the page and try the rest.

Question 1Manage Azure identities and governance

A contractor from a partner company needs to sign in and collaborate on a shared Azure DevOps project. The partner already has their own corporate email account. Which action should the administrator take in Microsoft Entra ID?

Choose one.

a
Use Invite external user to send a B2B collaboration invitation to the partner's email Correct
B2B collaboration invites an external person, who redeems the invitation and keeps signing in with their own home credentials.
b
Use Create new user to make a member account and set an initial password for the partner
A member account is for your own organization's staff and would require you to manage the partner's password, which B2B avoids.
c
Create a service principal for the partner's application
A service principal is an application identity, not a way to give a human collaborator sign-in access.
d
Add the partner to a Microsoft 365 group so they inherit access
A group organizes existing accounts; it does not create an identity for an external person who has no account in your tenant yet.

The concept

Member users are internal accounts; guest users are external collaborators invited through Microsoft Entra B2B collaboration.

Why that’s the answer

An external partner who already has their own corporate credentials should be a guest, created with Invite external user (B2B) so they redeem an invitation and sign in with their home account. Create new user (B) makes an internal member you must credential, which is wrong for an outsider. A service principal (C) is an app identity, not a person. Adding to a group (D) cannot conjure an identity that does not yet exist.

How to reason it out

Identify that the person belongs to another organization and already has credentials.
External collaborators map to guest (B2B) users, not members.
Choose Invite external user to send a B2B invitation.

Exam tip: External partner sign-in with their own credentials means a guest (B2B) invitation, not a member account.

Manage Microsoft Entra Users and Groups (AZ-104) — the lesson that teaches this.

Question 2Implement and manage storage

Which type of shared access signature (SAS) is secured with Microsoft Entra ID credentials instead of a storage account access key?

Choose one.

a
User delegation SAS Correct
Correct. A user delegation SAS is signed with a user delegation key obtained through Microsoft Entra ID credentials, so it never exposes or depends on the storage account access keys.
b
Account SAS
An account SAS is always signed with one of the two storage account access keys, not with Entra ID credentials.
c
Service SAS
A service SAS is also signed with a storage account access key; it scopes access to a single service but still relies on the key for its signature.
d
Stored access policy
A stored access policy is not a SAS type at all; it is a server-side policy that a service SAS can reference to centralize permissions and expiry.

The concept

Azure Storage supports three SAS types: account SAS, service SAS, and user delegation SAS. The first two are signed with a storage account access key; the user delegation SAS is signed with a user delegation key requested via Microsoft Entra ID.

Why that’s the answer

The user delegation SAS is the only SAS type whose signature is based on Entra ID credentials. A principal with the right RBAC permissions requests a user delegation key from the Blob service and uses it to sign the SAS, so the account keys never need to be handled or distributed. Account SAS and service SAS both fail this requirement because their signatures come from the shared account keys, and a stored access policy is a management construct for service SAS tokens, not a SAS itself.

How to reason it out

Recall the three SAS types: account SAS, service SAS, and user delegation SAS.
Identify what signs each one: account keys for account and service SAS, an Entra-issued user delegation key for the user delegation SAS.
Eliminate the stored access policy option because it is a policy referenced by a service SAS, not a signature mechanism.
Select user delegation SAS as the Entra-secured option, which is also Microsoft's recommended SAS type for Blob Storage.

Exam tip: A user delegation SAS is signed with Microsoft Entra ID credentials, making it the most secure SAS type because account keys are never used.

Configure Access to Azure Storage: SAS, Keys & Firewalls (AZ-104) — the lesson that teaches this.

Question 3Deploy and manage Azure compute resources

An administrator authors infrastructure definitions in a Bicep file named main.bicep. What does the Bicep CLI produce when the administrator runs 'bicep build main.bicep'?

Choose one.

a
An ARM template in JSON format that Azure Resource Manager can deploy Correct
Bicep is a transparent abstraction over ARM JSON — 'bicep build' transpiles the .bicep file into an equivalent ARM template (main.json) that Resource Manager understands.
b
A compiled binary executable that provisions the resources directly
Bicep is a declarative language, not a compiled program — it never produces executables and never provisions resources itself; deployment is always performed by Azure Resource Manager.
c
A YAML pipeline definition for Azure DevOps
Bicep has no relationship to pipeline YAML — CI/CD pipelines can invoke Bicep deployments, but the build command emits ARM JSON, not pipeline definitions.
d
A state file that records the current resources in the subscription
Bicep deliberately has no state file — Azure Resource Manager itself is the source of truth for deployed resources, unlike tools such as Terraform.

The concept

Bicep is a domain-specific language that transpiles to standard ARM JSON templates. Everything a Bicep file can express is expressed as an ARM template underneath, so the deployment engine and capabilities are identical.

Why that’s the answer

'bicep build' converts the .bicep source into an ARM template JSON file — this is the core relationship between the two languages. It does not produce executables (Bicep is declarative, not procedural), it does not generate pipeline YAML (a separate concern), and it maintains no state file because Azure Resource Manager is the source of truth for what exists.

How to reason it out

Author the infrastructure in main.bicep using Bicep's concise declarative syntax.
Run 'bicep build main.bicep' (or let the Azure CLI/PowerShell do it automatically at deploy time) to emit main.json.
Deploy either the .bicep file directly or the emitted JSON with 'az deployment group create' — Resource Manager processes the same ARM JSON either way.

Exam tip: Bicep transpiles to ARM JSON — same engine, same capabilities, friendlier syntax, and no state file.

ARM Templates and Bicep: AZ-104 Deployment Guide — the lesson that teaches this.

Question 4Implement and manage virtual networking

You are planning the address space for a new Azure virtual network that will never be exposed directly to the internet. Which address range is a valid RFC 1918 private range you can assign to the VNet?

Choose one.

a
10.20.0.0/16 Correct
10.0.0.0/8 is one of the three RFC 1918 private ranges, so any block carved from it, such as 10.20.0.0/16, is a valid private VNet address space.
b
11.0.0.0/16
11.0.0.0/8 is publicly routable address space (not part of RFC 1918), so using it risks conflicts with real internet destinations.
c
172.32.0.0/16
The RFC 1918 range in the 172 block is 172.16.0.0/12, which ends at 172.31.255.255 — 172.32.0.0 falls just outside it and is public space.
d
192.169.0.0/16
The RFC 1918 range is 192.168.0.0/16; 192.169.0.0/16 is adjacent public address space and should not be used for private networks.

The concept

Azure virtual networks should use RFC 1918 private address space: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Choosing public ranges can break connectivity to real internet endpoints and complicates future peering and hybrid connectivity.

Why that’s the answer

10.20.0.0/16 sits inside 10.0.0.0/8, one of the three RFC 1918 private ranges, so it is a safe, valid VNet address space. The distractors are traps built on off-by-one boundaries: 11.0.0.0/16 is outside 10.0.0.0/8 entirely, 172.32.0.0/16 is just past the end of 172.16.0.0/12 (which stops at 172.31.255.255), and 192.169.0.0/16 is just past 192.168.0.0/16. All three are publicly routable ranges.

How to reason it out

Memorize the three RFC 1918 ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Check whether the candidate range falls entirely inside one of those blocks — pay attention to the exact boundaries (172.16–172.31, not 172.32).
Also plan for uniqueness: pick ranges that will not overlap with other VNets or on-premises networks you may later peer or connect to.

Exam tip: Valid private VNet space comes from 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 — watch the exact block boundaries.

Azure Virtual Networks, Subnets, Peering & User-Defined Routes — the lesson that teaches this.

Question 5Monitor and maintain Azure resources

An administrator wants to view the average CPU percentage of an Azure virtual machine over the last hour, with data points that appear within a few minutes of being collected and no agent installation required. Which Azure Monitor data type should the administrator use?

Choose one.

a
Platform metrics Correct
Platform metrics are numeric time-series values collected automatically from Azure resources at near-real-time frequency. Host-level metrics such as Percentage CPU require no agent and are viewable immediately in metrics explorer.
b
Resource logs
Resource logs record operations performed within a resource and must be routed via a diagnostic setting before you can analyze them. They are event records, not lightweight numeric time-series data, and are not the fastest path to a CPU chart.
c
Activity log events
The activity log records subscription-level control-plane operations, such as who started or resized the VM. It contains no performance data like CPU percentage.
d
Application Insights traces
Application Insights collects application-level telemetry such as requests and dependencies from instrumented apps. It does not report host CPU for a VM and requires instrumentation to collect anything.

The concept

Azure Monitor stores two fundamental data types: metrics (lightweight numeric time-series values, collected at regular intervals, near-real-time) and logs (event and trace records with rich properties, queried with KQL in a Log Analytics workspace).

Why that’s the answer

Platform metrics fit every requirement in the scenario: they are collected automatically for all Azure resources with no agent, they are numeric samples suitable for charting an average, and they appear in metrics explorer within minutes. Resource logs need a diagnostic setting and a destination before analysis, the activity log only records control-plane operations (not performance counters), and Application Insights is app telemetry that requires instrumentation and never captures host CPU.

How to reason it out

Open the virtual machine in the Azure portal and select Metrics under Monitoring.
Choose the Percentage CPU metric from the Virtual Machine Host namespace.
Set the aggregation to Avg and the time range to the last hour to render the chart.

Exam tip: Platform metrics are agentless, numeric, and near-real-time; logs are event records that need routing and KQL to analyze.

Azure Monitor: Metrics, Logs, Diagnostic Settings & Alerts (AZ-104) — the lesson that teaches this.

The AZ-104 question bank, by domain

The bank is built to the exam's own weighting, so the practice you get reflects the marks that are actually on offer — not whichever domain was easiest to write questions for.

Published AZ-104 practice questions per exam domain
Domain	Exam weight	Topics	Questions
Manage Azure identities and governance	24%	3	60
Implement and manage storage	19%	3	60
Deploy and manage Azure compute resources	24%	4	80
Implement and manage virtual networking	19%	3	60
Monitor and maintain Azure resources	14%	2	40
Total	100%	15	300

How AZ-104 questions are worded

Most AZ-104 questions are not asking whether you can recall a definition. They describe a situation and ask which option satisfies it — so the skill being tested is reading the requirement precisely and eliminating options that fail it.

Single-response vs multiple-response

A single-response question has exactly one right answer. A multiple-response question tells you how many to pick ("Choose TWO") and there is no partial credit — getting one of the two right scores nothing. Read that instruction before you read the options.

Read the last line first

The final sentence is the actual question; everything before it is scenario. Read it first, then read the scenario knowing what you are looking for. It stops you from building an answer in your head that the question never asked for.

Hunt for the qualifier

Most scenarios turn on one word — MOST cost-effective, LEAST operational overhead, with the LEAST latency, without changing application code. Two options are frequently both technically correct, and the qualifier is the only thing separating them.

Eliminate, then choose

Distractors are almost always real Microsoft Azure services doing a real job — just not this job. Rule out the ones that break a stated constraint before you compare what's left. On a question you truly don't know, eliminating two options turns a guess into a coin flip.

Beyond AZ-104 practice

AZ-104 practice questions: your questions

Yes. You can answer 5 questions a day with no account at all, and creating a free account removes the daily limit entirely — the full 300-question AZ-104 bank, with an explanation on every option.