EnglishDeutschFrançaisEspañolPortuguês

Microsoft · AZ-104 · Associate

Microsoft Azure Administrator (AZ-104) — Practice Questions and Mock Exam

Prepare for AZ-104 with exam-style tasks, clear explanations and practice that adapts to your progress.

Practice for freeTry a practice question first
Try a practice question firstPractice for free
Start practicing AZ-104 freeBuy AZ-104 access for $29.99
50Questions per Pass-IT mock exam
100minPass-IT mock exam time limit

Official AZ-104 exam: 700 out of 1000 points to pass.

Checked against Microsoft · August 2026 · Current exam version

Editorial update:

Try Pass-IT

See what learning with Pass-IT is like.

Answer a AZ-104 sample question and read the explanation with its source. Right here, with no sign-up.

Deploy and manage Azure compute resources1 / 5

Deploying a virtual machine into an availability zone protects it from a complete datacenter failure within an Azure region. Does this solution meet the goal?

AlexFull explanation from Alex

The correct answer is False. Deploying a virtual machine into a single availability zone pins it to that zone. If the datacenters behind that zone suffer a complete failure, the VM goes down with them — a zonal VM is protected from failures in *other* zones, not from the failure of its own. As stated in the official documentation: "Many Azure regions provide availability zones, which are separated groups of datacenters within a region. Each availability zone has independent power, cooling, and networking." Protection against a complete datacenter failure comes from deploying resources *across multiple* availability zones, or from using zone-redundant services: when one zone goes down, instances in the remaining zones keep running. the option “True” (True) is incorrect because it describes the benefit of a multi-zone deployment, not of placing one VM in one zone. For a single zonal VM, a complete failure of its own zone's datacenter is exactly the scenario it is not protected against — which is why Microsoft recommends spreading VMs across availability zones for high availability. (Source: https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview)

Sourcelearn.microsoft.com

Implement and manage storage2 / 5

You have a storage account with blob versioning enabled. A user accidentally overwrites an important blob. You need to restore the previous version. What should you do?

AlexFull explanation from Alex

When blob versioning is enabled, earlier versions of a blob remain available after modification or deletion. To restore the current blob after an overwrite, copy the desired previous version over the base blob. Change Feed is for tracking changes, not restoring content. Soft delete is a data protection feature and can protect deleted or overwritten data depending on configuration, but the versioning restore procedure is to promote or copy the previous version to the current blob.

Sourcelearn.microsoft.com

Monitor and maintain Azure resources3 / 5

You are configuring Azure Monitor alerts for a web application. You need an alert that evaluates a KQL query against Log Analytics data every 5 minutes and fires when the count of HTTP 500 errors exceeds 10. Which alert type should you create?

AlexFull explanation from Alex

Log search alert rules are the correct choice because they evaluate a KQL (Kusto Query Language) query against data in a Log Analytics workspace at a defined frequency. When the query results meet a specified condition (e.g., count of HTTP 500 errors > 10), the alert fires. According to Microsoft documentation, Azure Monitor alerts allow you to 'alert on any metric or log data source in the Azure Monitor data platform.' Log search alerts specifically operate by running log queries at regular intervals against Log Analytics or Application Insights data.

Why each incorrect option is wrong:

  • A. Smart detection alert: Smart detection is a feature of Application Insights that automatically detects performance anomalies and potential problems using machine learning. It does not allow you to define custom KQL queries with specific thresholds and evaluation intervals — it is proactive and automatic, not user-configured in this way.
  • C. Metric alert rule: Metric alerts evaluate numeric metric data (e.g., CPU percentage, memory usage) at regular intervals. While they can work with metrics from Log Analytics via 'metric alerts for logs,' the scenario explicitly describes evaluating a KQL query against Log Analytics data, which is the defining characteristic of a log search alert rule, not a metric alert rule.
  • D. Activity log alert rule: Activity log alerts trigger based on Azure resource management events recorded in the Activity Log, such as when a VM is deallocated or a resource is created/deleted. They do not evaluate KQL queries against application telemetry or custom log data.

(Source: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview)

Sourcelearn.microsoft.com

Manage Azure identities and governance4 / 5

A user is assigned the Contributor role at a management group that contains Subscription A and Subscription B. They can manage resources in Subscription A, but they cannot manage resources in Subscription B. Subscription B has a deny assignment. Identify where the issue is most likely occurring.

AlexFull explanation from Alex

Azure RBAC scopes form a hierarchy: management group, subscription, resource group, and resource. Role assignments at parent scopes are inherited by child scopes. Deny assignments are different from additive role assignments because they block actions even when a role assignment grants access. When access works in one child subscription but not another, check for deny assignments or other restrictions at the failing subscription or below.

Sourcelearn.microsoft.com

How to prepare for AZ-104 with Pass-IT.

Currently 552 practice questions for AZ-104, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Meet Alex →

Conversation preview · AZ-104

Azure access permissions

  1. You

    I’m a Contributor. Why can my access still be blocked?

  2. Alex · AI tutor

    A deny assignment can block specific actions even when your role allows them. What matters is whether the restriction applies to you and the action you want to take.

    Read the Microsoft documentation ↗
  3. You

    Would adding another role help?

  4. Alex · AI tutor

    An additional role does not override that restriction. Check which actions the deny assignment blocks and whom it applies to.

    Read the Microsoft documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

AZ-104 · Question excerpt

Restore an overwritten blob

View the full question

You have a storage account with blob versioning enabled. A user accidentally overwrites an important blob. You need to restore the previous version. What should you do?

Understand the correct answer.

Copy the previous version over the current blob

Versioning preserves the earlier version. You can copy it over the current blob.

Read the Microsoft documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your AZ-104 mock exam

Questions
50
Minutes
100

Illustration of an exam session

  1. Start
  2. Answer questions
  3. Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for AZ-104.

Exam topics, relevant practice and sources you can check.

Identities, access and governance20–25% of the exam134 QuestionsChecked against sources

This section covers the people, permissions and administrative rules behind an Azure environment.

  • Create and maintain Entra users and groups, their properties and licenses, external users and self-service password reset.
  • Manage built-in Azure roles, assign them at suitable scopes and interpret who has access to which resources.
  • Apply Azure Policy, resource locks and tags, and organize resource groups, subscriptions and management groups.
  • Manage spending with cost alerts, budgets and Azure Advisor recommendations.

15 of 15 learning objectives with linked practice questions

Official objectives from Microsoft
Source check
134 of 134 questions
Additional challenge review
133 of 134 questions
View review evidence
Source check · Evidence updated
Challenge review · Log entry added

These dates show the latest matching evidence in the domain, not a new review of every question.

How we review questions
Storage configuration and protection15–20% of the exam99 QuestionsChecked against sources

Understand how to create Azure storage, control access and protect stored data.

  • Configure storage firewalls and virtual networks, shared access signatures (SAS), stored access policies, access keys and identity-based access to Azure Files.
  • Create storage accounts with suitable redundancy, object replication and encryption, and manage data with Storage Explorer and AzCopy.
  • Create Azure Files shares and Blob Storage containers, and configure storage tiers.
  • Configure soft delete for blobs, containers and Azure Files, file-share snapshots, blob lifecycle rules and blob versioning.

17 of 17 learning objectives with linked practice questions

Official objectives from Microsoft
Source check
99 of 99 questions
Additional challenge review
99 of 99 questions
View review evidence
Source check · Evidence updated
Challenge review · Log entry added

These dates show the latest matching evidence in the domain, not a new review of every question.

How we review questions
Deploying compute resources20–25% of the exam135 QuestionsChecked against sources

This section covers repeatable deployments and the operation of virtual machines, containers and web applications.

  • Read and modify ARM templates and Bicep files, deploy resources from them, export deployments as ARM templates and convert ARM templates to Bicep.
  • Create virtual machines, configure host encryption, sizes and disks, and move machines between resource groups, subscriptions or regions.
  • Deploy virtual machines in availability zones and availability sets, and configure Virtual Machine Scale Sets.
  • Create and manage Azure Container Registry, deploy containers with Container Instances or Container Apps, and manage their sizing and scaling through the Azure portal.
  • Create App Service plans and apps, configure plan scaling, certificates and TLS, custom DNS names, backups, networking and deployment slots.

24 of 24 learning objectives with linked practice questions

Official objectives from Microsoft
Source check
135 of 135 questions
Additional challenge review
135 of 135 questions
View review evidence
Source check · Evidence updated
Challenge review · Log entry added

These dates show the latest matching evidence in the domain, not a new review of every question.

How we review questions
Networking and secure connections15–20% of the exam111 QuestionsChecked against sources

Understand how Azure networks route traffic, restrict access and distribute requests.

  • Create virtual networks and subnets, peering, public IP addresses and user-defined routes, and troubleshoot network connectivity.
  • Configure network and application security groups, evaluate effective security rules and implement Azure Bastion.
  • Configure service endpoints and private endpoints for Azure platform services.
  • Configure Azure DNS and internal or public load balancers, and troubleshoot load-balancing problems.

13 of 13 learning objectives with linked practice questions

Official objectives from Microsoft
Source check
111 of 111 questions
Additional challenge review
111 of 111 questions
View review evidence
Source check · Evidence updated
Challenge review · Log entry added

These dates show the latest matching evidence in the domain, not a new review of every question.

How we review questions
Monitoring, backup and recovery10–15% of the exam73 QuestionsChecked against sources

This section covers detecting problems, protecting data and restoring Azure services.

  • Interpret Azure Monitor metrics, configure and query logs, and set alert rules, action groups and alert-processing rules.
  • Configure and interpret Monitor Insights for virtual machines, storage and networks, and use Network Watcher and Connection Monitor to examine connectivity.
  • Create Recovery Services and Backup vaults, configure backup policies, run backups and restores, and configure and interpret backup reports and alerts.
  • Configure Azure Site Recovery and perform failover to a secondary region.

13 of 13 learning objectives with linked practice questions

Official objectives from Microsoft
Source check
73 of 73 questions
Additional challenge review
73 of 73 questions
View review evidence
Source check · Evidence updated
Challenge review · Log entry added

These dates show the latest matching evidence in the domain, not a new review of every question.

How we review questions
Question formats you can practice
Multiple Choice
Select one answer.
Multiple Response
Select multiple applicable answers.
True / False
Decide whether statements are true or false.
Drag & Drop
Match items to the appropriate targets.
Ordering
Put steps in the correct order.
Dropdown
Choose the appropriate entry from a dropdown list.

These are the formats available in Pass-IT. The exact mix in your Microsoft exam is not published in advance. The official exam sandbox shows possible question types and the exam interface.

Weightings from the Microsoft study guide.

Frequently asked questions

Your preparation

How much study time should I plan for AZ-104?

For planning, Pass-IT estimates roughly 30–75 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from Microsoft or a promise that you will be exam-ready within that time.

Do you need AZ-900 before AZ-104?

No. AZ-900 is not a formal prerequisite. Decide whether to review fundamentals by looking at what you can explain: subscriptions, resource groups, identity, and basic networking. If those concepts remain unclear, work through them before tackling administrative tasks that combine several services.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with Microsoft for the languages available for the official exam. Exam languages at Microsoft

How long does my AZ-104 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the AZ-104 exam

Where can I take the AZ-104 exam?

Pearson VUE online proctored or at authorized testing centers worldwide. Book your exam with Microsoft

How long is the Microsoft Azure Administrator exam?

Microsoft lists 100 minutes of exam time for AZ-104. The number of questions can vary. The 50 questions shown on this page are the setting for the Pass-IT mock exam. Exam details from Microsoft · Question count and exam experience

How do I renew my Azure Administrator certification?

Your Azure Administrator certification is valid for 12 months. During the six months before expiration, you can renew it through a free, unproctored online assessment on Microsoft Learn. Passing adds one year from the expiry date. This assessment is separate from the original proctored AZ-104 exam. Renewal at Microsoft

When can you retake AZ-104 after failing?

Microsoft requires 24 hours after the first failure and 14 days after the second and subsequent failures, with five attempts allowed in 12 months. Before booking again, turn unresolved topics into specific practice tasks you can complete and explain.

Your preparation for AZ-104

$29.99one-time

12 months of access for AZ-104 · No automatic renewal

Buy AZ-104 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →

Related guides

How to prepare for AZ-104 with practical Azure exercises

Related certifications

Administering Information Security in Microsoft 365Administering Microsoft Azure SQL SolutionsAdministering Windows ServerCollaboration Communications Systems EngineerAll Microsoft certifications →