Microsoft · AZ-104 · Associate

Microsoft Azure Administrator (AZ-104) — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Practice with realistic AZ-104 questions aligned to the exam objectives. Alex explains every answer, and your readiness score shows what to study next.

Buy AZ-104 access for $29.99 Take the free readiness check

One payment. Lifetime access to this certification.

Try 5 questions first →

50Questions

100minTime Limit

700/ 1000Pass Score

Checked against Microsoft · August 2026Current exam version

Overview

About the exam

The AZ-104 certification validates the skills required to implement, manage, and monitor an organization's Azure environment. It covers identity and governance, storage, compute, virtual networking, and monitoring — the core pillars of Azure administration. Candidates must demonstrate proficiency in using the Azure portal, Azure CLI, Azure PowerShell, and ARM templates.

This is Microsoft's most popular Azure administrator credential, designed for IT professionals who manage cloud infrastructure day to day. It is the recommended certification for system administrators, infrastructure engineers, and operations teams transitioning to or already working with Azure cloud services.

Exam domains

What's on the exam

Governance and compute carry the most weight, each landing in the 20–25% range, which puts identity management, RBAC, cost controls, VM provisioning, and container services at the center of the exam. Storage and networking follow close behind at 15–20% apiece, covering blob and file configuration alongside VNets, NSGs, and DNS. Monitoring closes out the blueprint at 10–15%, testing Azure Monitor and backup scenarios rather than day-one setup tasks.

The split reflects how administrators spend their week: more time provisioning and governing resources than watching dashboards after the fact. Candidates who treat monitoring as an afterthought underestimate the exam's questions on alert rules, Log Analytics queries, and Recovery Services vault configuration.

Exam blueprint: AZ-104

Manage Azure identities and governance20–25%

Manage Microsoft Entra users and groups, manage access to Azure resources with RBAC, and manage Azure subscriptions and governance including Azure Policy, resource locks, tags, management groups, and cost management

≈ 12 h

Implement and manage storage15–20%

Configure access to storage (firewalls, SAS tokens, access keys, identity-based access), configure and manage storage accounts (redundancy, replication, encryption), and configure Azure Files and Blob Storage (tiers, lifecycle management, versioning, soft delete)

≈ 10 h

Deploy and manage Azure compute resources20–25%

Automate deployments with ARM templates or Bicep, create and configure VMs (encryption, availability zones/sets, scale sets), provision and manage containers (Container Registry, Container Instances, Container Apps), and create/configure Azure App Service

≈ 12 h

Implement and manage virtual networking15–20%

Configure and manage virtual networks and subnets (peering, public IPs, UDRs), configure secure access (NSGs, ASGs, Azure Bastion, service/private endpoints), and configure name resolution and load balancing (Azure DNS, load balancers)

≈ 10 h

Monitor and maintain Azure resources10–15%

Monitor resources using Azure Monitor (metrics, logs, alerts, Insights, Network Watcher) and implement backup and recovery (Recovery Services vault, Azure Backup, Azure Site Recovery, failover)

≈ 7 h

Format

Exam format and question types

The exam draws 40–60 questions from a mix of multiple-choice, multiple-select, drag-and-drop, hot-area, and case-study formats inside a 100-minute window. Most items are scenario-based: a description of an environment or requirement, followed by a decision about which Azure CLI command, PowerShell cmdlet, or portal setting solves it. Case studies bundle several questions around one scenario; allocate extra time for them rather than budgeting evenly per question.

Question types: AZ-104

Multiple Choice41%

Pick the single best answer from four or five options — the exam's bread and butter.

Drag & Drop17%

Drag items into the right slot, group or order — it tests whether you can apply a concept, not just recognise it.

Ordering11%

Put the steps of a process into the correct sequence — typically deployment or troubleshooting workflows.

Multiple Response11%

More than one answer is correct and you need all of them; the question tells you how many to pick.

Dropdown11%

Complete a statement or a configuration by picking from dropdown menus inside the text.

True / False9%

Judge a single statement as true or false — quick points, but the exact wording decides.

Microsoft confirms these question types — a percentage split is not published; the shares reflect our exam-aligned question pool.

Try it now

Try five AZ-104 questions

Five questions straight from our Microsoft Azure Administrator pool. Answer one — Alex explains the why.

Implement and manage virtual networking1 / 5

You need to enable Accelerated Networking on an existing Azure VM to improve network performance. What must you do before enabling it?

AlexFull explanation from Alex

To enable Accelerated Networking on an existing Azure VM's network interface, you must first deallocate (stop) the VM. Accelerated Networking uses single root I/O virtualization (SR-IOV) to provide significantly improved networking performance by bypassing the host's virtual switch. This feature can only be toggled on an existing VM's NIC when the VM is in a stopped (deallocated) state. According to Microsoft documentation, you must stop/deallocate the VM before you can enable accelerated networking on any existing NIC. Why the option “Deallocate (stop) the VM before enabling Accelerated…” is correct: Azure requires the VM to be in a deallocated state before modifying the accelerated networking setting on its NIC. This is because enabling SR-IOV requires changes to the underlying hardware allocation that cannot be performed while the VM is running. Why the other options are wrong: - the option “Resize the VM to a GPU-enabled size” (Resize the VM to a GPU-enabled size): While accelerated networking does require a supported VM size, it does not specifically require a GPU-enabled size. Many general-purpose and compute-optimized VM sizes support accelerated networking. GPU-enabled sizes are designed for graphics and compute workloads, not a prerequisite for accelerated networking. - the option “Detach all data disks from the VM” (Detach all data disks from the VM): Data disks have no relationship to network interface configuration. Accelerated networking is a NIC-level feature and does not require any changes to disk attachments. - the option “Move the VM to a different subnet” (Move the VM to a different subnet): Subnet placement has no bearing on whether accelerated networking can be enabled. Accelerated networking is a NIC hardware feature, not a networking topology feature. (Source: https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-overview)

Sourcelearn.microsoft.com

Manage Azure identities and governance2 / 5

A user is assigned the Contributor role at a management group that contains Subscription A and Subscription B. They can manage resources in Subscription A, but they cannot manage resources in Subscription B. Subscription B has a deny assignment. Identify where the issue is most likely occurring.

AlexFull explanation from Alex

Azure RBAC scopes form a hierarchy: management group, subscription, resource group, and resource. Role assignments at parent scopes are inherited by child scopes. Deny assignments are different from additive role assignments because they block actions even when a role assignment grants access. When access works in one child subscription but not another, check for deny assignments or other restrictions at the failing subscription or below.

Sourcelearn.microsoft.com

Deploy and manage Azure compute resources3 / 5

Deploying a virtual machine into an availability zone protects it from a complete datacenter failure within an Azure region. Does this solution meet the goal?

AlexFull explanation from Alex

The correct answer is False. Deploying a virtual machine into a single availability zone pins it to that zone. If the datacenters behind that zone suffer a complete failure, the VM goes down with them — a zonal VM is protected from failures in *other* zones, not from the failure of its own. As stated in the official documentation: "Many Azure regions provide availability zones, which are separated groups of datacenters within a region. Each availability zone has independent power, cooling, and networking." Protection against a complete datacenter failure comes from deploying resources *across multiple* availability zones, or from using zone-redundant services: when one zone goes down, instances in the remaining zones keep running. the option “True” (True) is incorrect because it describes the benefit of a multi-zone deployment, not of placing one VM in one zone. For a single zonal VM, a complete failure of its own zone's datacenter is exactly the scenario it is not protected against — which is why Microsoft recommends spreading VMs across availability zones for high availability. (Source: https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview)

Sourcelearn.microsoft.com

Implement and manage storage4 / 5

You have a storage account with blob versioning enabled. A user accidentally overwrites an important blob. You need to restore the previous version. What should you do?

AlexFull explanation from Alex

When blob versioning is enabled, earlier versions of a blob remain available after modification or deletion. To restore the current blob after an overwrite, copy the desired previous version over the base blob. Change Feed is for tracking changes, not restoring content. Soft delete is a data protection feature and can protect deleted or overwritten data depending on configuration, but the versioning restore procedure is to promote or copy the previous version to the current blob.

Sourcelearn.microsoft.com

Monitor and maintain Azure resources5 / 5

You are configuring Azure Monitor alerts for a web application. You need an alert that evaluates a KQL query against Log Analytics data every 5 minutes and fires when the count of HTTP 500 errors exceeds 10. Which alert type should you create?

AlexFull explanation from Alex

Log search alert rules are the correct choice because they evaluate a KQL (Kusto Query Language) query against data in a Log Analytics workspace at a defined frequency. When the query results meet a specified condition (e.g., count of HTTP 500 errors > 10), the alert fires. According to Microsoft documentation, Azure Monitor alerts allow you to 'alert on any metric or log data source in the Azure Monitor data platform.' Log search alerts specifically operate by running log queries at regular intervals against Log Analytics or Application Insights data.

Why each incorrect option is wrong:

A. Smart detection alert: Smart detection is a feature of Application Insights that automatically detects performance anomalies and potential problems using machine learning. It does not allow you to define custom KQL queries with specific thresholds and evaluation intervals — it is proactive and automatic, not user-configured in this way.

C. Metric alert rule: Metric alerts evaluate numeric metric data (e.g., CPU percentage, memory usage) at regular intervals. While they can work with metrics from Log Analytics via 'metric alerts for logs,' the scenario explicitly describes evaluating a KQL query against Log Analytics data, which is the defining characteristic of a log search alert rule, not a metric alert rule.

D. Activity log alert rule: Activity log alerts trigger based on Azure resource management events recorded in the Activity Log, such as when a VM is deallocated or a resource is created/deleted. They do not evaluate KQL queries against application telemetry or custom log data.

(Source: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview)

Sourcelearn.microsoft.com

Question pool

476 questions, built like the exam

Every domain of the AZ-104 exam has enough questions in the pool to practice it in depth. A mock exam asks 50 questions in one sitting, on the same 100-minute clock as the real thing.

Audit record: AZ-104

Spec check against MicrosoftAugust 28, 2026

last verified against the official Microsoft source

Pass mark700 / 1,000

as published by Microsoft

Blueprint coverage97 official objectives

across 5 domains, from the official exam guide

Pool size476 questions

= 9 full practice exams of 50 questions each — never the same question twice

Domain coverageall 5 domains at official weight

Manage Azure identities and governance 113 · Implement and manage storage 90 · Deploy and manage Azure compute resources 113 · Implement and manage virtual networking 93 · Monitor and maintain Azure resources 67

Canonically validated476 of 476

each verified against official Microsoft documentation — answer, options and explanation, source cited

Methodology openly documented.How questions are made →

Planning

Preparing for AZ-104

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

The exam runs through Pearson VUE, either online with a remote proctor or at an authorized testing center, and is offered in English, Japanese, Chinese, Korean, French, German, Spanish, and several other languages depending on location. Certification holds for one year, and Microsoft opens a free renewal assessment on Learn starting six months before it expires.

Your plan: AZ-104

Preparation

Study time30–75 h

typically around 30 h if you already work with this stack, around 75 h coming to it fresh

LevelAssociate

Exam day & after

DeliveryPearson VUE online proctored or at authorized testing centers worldwide

Retake policy24-hour wait after the first attempt, 14 days between subsequent attempts, maximum 5 attempts per exam within a 12-month period

Stays valid1 year

Free renewal assessment on Microsoft Learn, available starting 6 months before expiration. Must be completed before the certification expires.

Official guideView on vendor site

The hours are our own planning estimate — Microsoft publishes no preparation time for this exam. A starting point for your calendar, not a target.

Watch out

Common pitfalls

The exam tests judgment calls that only develop through hands-on work — knowing when a policy assignment governs behavior that a role assignment can't, working out NSG priority and evaluation order under pressure, or recalling which storage redundancy tier survives a regional outage. Portal-only practice also hides the Azure CLI and PowerShell syntax differences the exam expects candidates to recognize on sight. The same gap shows up in networking questions: VNet peering looks transitive until a multi-hop scenario proves otherwise.

Watch list: AZ-104

01RBAC vs Policies
Confusing Azure RBAC role assignments with Azure Policy assignments and when to use each for governance.
02Network Security
Not understanding NSG rule evaluation order, priority numbers, and how they interact with Azure Firewall.
03Storage Redundancy
Mixing up LRS, ZRS, GRS, and RA-GRS storage redundancy options and their availability characteristics.
04CLI Syntax
Struggling with Azure CLI and PowerShell command syntax differences for common administrative tasks.
05VNet Peering
Overlooking VNet peering transitivity limitations and the need for gateway transit configurations.

Pass-IT trains you on exactly these weak spots — adaptive & spaced →

Questions

Frequently asked questions

How long is the Microsoft Azure Administrator exam?

The AZ-104 exam has 50 questions and a 100-minute time limit.

What is the passing score for Microsoft Azure Administrator?

You need 700 / 1000 to pass the AZ-104 exam.

What are common mistakes on the Microsoft Azure Administrator exam?

Common pitfalls include: RBAC vs Policies, Network Security, Storage Redundancy, CLI Syntax, VNet Peering. Focus study time on these areas to avoid losing points.

How often do you have to renew AZ-104?

Azure Administrator Associate stays valid for one year. Microsoft renews it through a free assessment on Microsoft Learn that opens six months before your expiry date, not by making you sit AZ-104 again. Miss the window and the certification lapses, so the renewal has to be done before the date, not after.

Do you need AZ-900 before AZ-104?

No. Microsoft sets no formal prerequisite for AZ-104, so you can book it directly. AZ-900 is a fundamentals exam that covers cloud vocabulary rather than administration, so it helps if you are new to Azure and adds little if you already run resources day to day.

Which AZ-104 topics carry the most marks?

Identity and governance and compute resources are the two heaviest areas at roughly 24% each, with storage and virtual networking around 19% and monitoring near 14%. Microsoft publishes these as ranges rather than fixed numbers, so treat them as proportions, not a scoring formula. Practically it means half the exam sits in identity, governance and compute.

What happens if you fail AZ-104?

You can retake it after 24 hours. From the third attempt onwards Microsoft asks for 14 days between tries, and caps you at five attempts on the same exam within 12 months.

What should you take after AZ-104?

AZ-305 is the usual next step if you want to move from running Azure to designing it, and AZ-400 if your work is drifting towards DevOps. On the security side SC-500 now covers the ground AZ-500 used to.

How should you study for AZ-104?

Most people underestimate how much of AZ-104 is command syntax and how little is theory, so reading alone tends to stall around the halfway mark. Around 50 hours is a realistic budget if you already work with Azure. Our guide breaks that down week by week. Read the AZ-104 study guide

Pass-IT is an independent study tool, not affiliated with or endorsed by Microsoft; Microsoft and exam names are trademarks of their respective owners.

One certification. One payment.

Full AZ-104 access

Get the full question pool for this certification. Alex explains every answer, and your readiness score shows what to work on next.

Buy AZ-104 access for $29.99One payment. Lifetime access to this certification.

Take the free readiness check20 questions. No card. See what to study before you buy.

Reach 80% readiness and pass — or your money back.

How the score works →