Microsoft · AZ-104 · Associate

Microsoft Azure Administrator (AZ-104) — Practice Questions and Mock Exam

Name: Pass-IT
Author: Pass-IT

Prepare for AZ-104 with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing AZ-104 free Buy AZ-104 access for $29.99

Buy AZ-104 access for $29.99 Start practicing AZ-104 free

50Mock exam questions

100minTime limit

700/ 1000Passing score

Checked against Microsoft · August 2026 · Current exam version

Editorial update: September 10, 2026

Overview

About the exam

The AZ-104 certification validates the skills required to implement, manage, and monitor an organization's Azure environment. It covers identity and governance, storage, compute, virtual networking, and monitoring — the core pillars of Azure administration. Candidates must demonstrate proficiency in using the Azure portal, Azure CLI, Azure PowerShell, and ARM templates.

This is Microsoft's most popular Azure administrator credential, designed for IT professionals who manage cloud infrastructure day to day. It is the recommended certification for system administrators, infrastructure engineers, and operations teams transitioning to or already working with Azure cloud services.

Try the practice preview

Try five AZ-104 questions

Try five practice questions from the app’s current Microsoft Azure Administrator question bank, with answers and explanations.

Implement and manage virtual networking1 / 5

You need to enable Accelerated Networking on an existing Azure VM to improve network performance. What must you do before enabling it?

AlexFull explanation from Alex

To enable Accelerated Networking on an existing Azure VM's network interface, you must first deallocate (stop) the VM. Accelerated Networking uses single root I/O virtualization (SR-IOV) to provide significantly improved networking performance by bypassing the host's virtual switch. This feature can only be toggled on an existing VM's NIC when the VM is in a stopped (deallocated) state. According to Microsoft documentation, you must stop/deallocate the VM before you can enable accelerated networking on any existing NIC. Why the option “Deallocate (stop) the VM before enabling Accelerated…” is correct: Azure requires the VM to be in a deallocated state before modifying the accelerated networking setting on its NIC. This is because enabling SR-IOV requires changes to the underlying hardware allocation that cannot be performed while the VM is running. Why the other options are wrong: - the option “Resize the VM to a GPU-enabled size” (Resize the VM to a GPU-enabled size): While accelerated networking does require a supported VM size, it does not specifically require a GPU-enabled size. Many general-purpose and compute-optimized VM sizes support accelerated networking. GPU-enabled sizes are designed for graphics and compute workloads, not a prerequisite for accelerated networking. - the option “Detach all data disks from the VM” (Detach all data disks from the VM): Data disks have no relationship to network interface configuration. Accelerated networking is a NIC-level feature and does not require any changes to disk attachments. - the option “Move the VM to a different subnet” (Move the VM to a different subnet): Subnet placement has no bearing on whether accelerated networking can be enabled. Accelerated networking is a NIC hardware feature, not a networking topology feature. (Source: https://learn.microsoft.com/en-us/azure/virtual-network/accelerated-networking-overview)

Sourcelearn.microsoft.com

Manage Azure identities and governance2 / 5

A user is assigned the Contributor role at a management group that contains Subscription A and Subscription B. They can manage resources in Subscription A, but they cannot manage resources in Subscription B. Subscription B has a deny assignment. Identify where the issue is most likely occurring.

AlexFull explanation from Alex

Azure RBAC scopes form a hierarchy: management group, subscription, resource group, and resource. Role assignments at parent scopes are inherited by child scopes. Deny assignments are different from additive role assignments because they block actions even when a role assignment grants access. When access works in one child subscription but not another, check for deny assignments or other restrictions at the failing subscription or below.

Sourcelearn.microsoft.com

Deploy and manage Azure compute resources3 / 5

Deploying a virtual machine into an availability zone protects it from a complete datacenter failure within an Azure region. Does this solution meet the goal?

AlexFull explanation from Alex

The correct answer is False. Deploying a virtual machine into a single availability zone pins it to that zone. If the datacenters behind that zone suffer a complete failure, the VM goes down with them — a zonal VM is protected from failures in *other* zones, not from the failure of its own. As stated in the official documentation: "Many Azure regions provide availability zones, which are separated groups of datacenters within a region. Each availability zone has independent power, cooling, and networking." Protection against a complete datacenter failure comes from deploying resources *across multiple* availability zones, or from using zone-redundant services: when one zone goes down, instances in the remaining zones keep running. the option “True” (True) is incorrect because it describes the benefit of a multi-zone deployment, not of placing one VM in one zone. For a single zonal VM, a complete failure of its own zone's datacenter is exactly the scenario it is not protected against — which is why Microsoft recommends spreading VMs across availability zones for high availability. (Source: https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview)

Sourcelearn.microsoft.com

Implement and manage storage4 / 5

You have a storage account with blob versioning enabled. A user accidentally overwrites an important blob. You need to restore the previous version. What should you do?

AlexFull explanation from Alex

When blob versioning is enabled, earlier versions of a blob remain available after modification or deletion. To restore the current blob after an overwrite, copy the desired previous version over the base blob. Change Feed is for tracking changes, not restoring content. Soft delete is a data protection feature and can protect deleted or overwritten data depending on configuration, but the versioning restore procedure is to promote or copy the previous version to the current blob.

Sourcelearn.microsoft.com

Monitor and maintain Azure resources5 / 5

You are configuring Azure Monitor alerts for a web application. You need an alert that evaluates a KQL query against Log Analytics data every 5 minutes and fires when the count of HTTP 500 errors exceeds 10. Which alert type should you create?

AlexFull explanation from Alex

Log search alert rules are the correct choice because they evaluate a KQL (Kusto Query Language) query against data in a Log Analytics workspace at a defined frequency. When the query results meet a specified condition (e.g., count of HTTP 500 errors > 10), the alert fires. According to Microsoft documentation, Azure Monitor alerts allow you to 'alert on any metric or log data source in the Azure Monitor data platform.' Log search alerts specifically operate by running log queries at regular intervals against Log Analytics or Application Insights data.

Why each incorrect option is wrong:

A. Smart detection alert: Smart detection is a feature of Application Insights that automatically detects performance anomalies and potential problems using machine learning. It does not allow you to define custom KQL queries with specific thresholds and evaluation intervals — it is proactive and automatic, not user-configured in this way.

C. Metric alert rule: Metric alerts evaluate numeric metric data (e.g., CPU percentage, memory usage) at regular intervals. While they can work with metrics from Log Analytics via 'metric alerts for logs,' the scenario explicitly describes evaluating a KQL query against Log Analytics data, which is the defining characteristic of a log search alert rule, not a metric alert rule.

D. Activity log alert rule: Activity log alerts trigger based on Azure resource management events recorded in the Activity Log, such as when a VM is deallocated or a resource is created/deleted. They do not evaluate KQL queries against application telemetry or custom log data.

(Source: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview)

Sourcelearn.microsoft.com

Create a free account

Question pool

552 practice questions

The Pass-IT question pool gives you material to practice for AZ-104. A Pass-IT mock exam uses 50 questions and a 100-minute time limit; these are practice settings.

Pool details: AZ-104

Exam details checked against MicrosoftAugust 28, 2026

date of the last check against the official Microsoft source

Passing score700 / 1,000

as published by Microsoft

Objectives in the guide97 objectives listed in the official guide

across 5 domains in the official exam guide

Pool size552 questions

= The pool size is equivalent to 11 sets of 50 questions; this does not mean that each mock exam uses a separate set.

Blueprint domains5 domains in the exam blueprint

Manage Azure identities and governance 134 · Implement and manage storage 99 · Deploy and manage Azure compute resources 135 · Implement and manage virtual networking 111 · Monitor and maintain Azure resources 73

Recorded as checked against sources552 of 552

questions recorded as having their answer, options, and explanation checked against official Microsoft documentation

How questions are made →

Exam domains

What's on the exam

Governance and compute carry the most weight, each landing in the 20–25% range, which puts identity management, RBAC, cost controls, VM provisioning, and container services at the center of the exam. Storage and networking follow close behind at 15–20% apiece, covering blob and file configuration alongside VNets, NSGs, and DNS. Monitoring closes out the blueprint at 10–15%, testing Azure Monitor and backup scenarios rather than day-one setup tasks.

The split reflects how administrators spend their week: more time provisioning and governing resources than watching dashboards after the fact. Candidates who treat monitoring as an afterthought underestimate the exam's questions on alert rules, Log Analytics queries, and Recovery Services vault configuration.

Exam blueprint: AZ-104

Manage Azure identities and governance20–25%

Manage Microsoft Entra users and groups, manage access to Azure resources with RBAC, and manage Azure subscriptions and governance including Azure Policy, resource locks, tags, management groups, and cost management

≈ 12 h

Implement and manage storage15–20%

Configure access to storage (firewalls, SAS tokens, access keys, identity-based access), configure and manage storage accounts (redundancy, replication, encryption), and configure Azure Files and Blob Storage (tiers, lifecycle management, versioning, soft delete)

≈ 10 h

Deploy and manage Azure compute resources20–25%

Automate deployments with ARM templates or Bicep, create and configure VMs (encryption, availability zones/sets, scale sets), provision and manage containers (Container Registry, Container Instances, Container Apps), and create/configure Azure App Service

≈ 12 h

Implement and manage virtual networking15–20%

Configure and manage virtual networks and subnets (peering, public IPs, UDRs), configure secure access (NSGs, ASGs, Azure Bastion, service/private endpoints), and configure name resolution and load balancing (Azure DNS, load balancers)

≈ 10 h

Monitor and maintain Azure resources10–15%

Monitor resources using Azure Monitor (metrics, logs, alerts, Insights, Network Watcher) and implement backup and recovery (Recovery Services vault, Azure Backup, Azure Site Recovery, failover)

≈ 7 h

Format

Exam format and question types

The exam draws 40–60 questions from a mix of multiple-choice, multiple-select, drag-and-drop, hot-area, and case-study formats inside a 100-minute window. Most items are scenario-based: a description of an environment or requirement, followed by a decision about which Azure CLI command, PowerShell cmdlet, or portal setting solves it. Case studies bundle several questions around one scenario; allocate extra time for them rather than budgeting evenly per question.

Question types: AZ-104

Multiple Choice41%

Select the single answer that best meets the question’s requirements.

Drag & Drop17%

Move items into the slots, groups, or sequence specified by the task.

Ordering11%

Arrange the steps in the sequence needed to complete the process.

Multiple Response11%

Select multiple answers. Follow the question’s instructions on how many to choose.

Dropdown11%

Choose options from dropdown menus to complete a statement or configuration.

True / False9%

Decide whether a statement is true or false, paying attention to its conditions and wording.

See Microsoft for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Planning

Preparing for AZ-104

AZ-104 preparation, exam arrangements, and certification validity and renewal.

Preparation and logistics: AZ-104

Preparation

Illustrative study time30–75 h

illustrative planning range: 30 h with relevant experience to 75 h when starting out; your needs may fall outside this range

LevelAssociate

Taking and maintaining the certification

DeliveryPearson VUE online proctored or at authorized testing centers worldwide

Retake policy24-hour wait after the first attempt, 14 days between subsequent attempts, maximum 5 attempts per exam within a 12-month period

Certification validity1 year

Your certification is valid for 12 months. Pass the free, unproctored online renewal assessment on Microsoft Learn during the six months before expiration to extend it by one year from its expiry date.

Source: Microsoft

Official guideView on provider site

Study notes

Common pitfalls

Potential errors in Azure access, networking, and storage configurations.

Topics to review: AZ-104

01RBAC vs Policies
Separate permission to perform an operation from rules governing resource configuration. Test the relevant assignments and explain which constraint accounts for the result.
02Network Security
Trace the traffic path and evaluate the applicable NSG rules by priority. If Azure Firewall is involved, examine its rules separately.
03Storage Redundancy
Compare LRS, ZRS, GRS, and RA-GRS against a specific failure scenario. Distinguish replicated data from the ability to read it during an outage.
04CLI Syntax
Perform the same small task with Azure CLI and PowerShell. Identify the required parameters, selected subscription, and resource scope in each.
05VNet Peering
Draw each connection and verify the full route. Do not assume that peering through an intermediate VNet provides connectivity; examine routing and gateway transit requirements.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the Microsoft Azure Administrator exam?

The AZ-104 exam has 50 questions and a 100-minute time limit.

What is the passing score for Microsoft Azure Administrator?

The passing score for the AZ-104 exam is 700 / 1000.

Which pitfalls should I review when preparing for Microsoft Azure Administrator?

Topics to review include RBAC vs Policies, Network Security, Storage Redundancy, CLI Syntax, VNet Peering. Work through examples to check that you understand the distinctions and can explain your answer.

How do I renew my Azure Administrator certification?

Your Azure Administrator certification is valid for 12 months. During the six months before expiration, you can renew it through a free, unproctored online assessment on Microsoft Learn. Passing adds one year from the expiry date. This assessment is separate from the original paid, proctored AZ-104 exam.

Do you need AZ-900 before AZ-104?

No. AZ-900 is not a formal prerequisite. Decide whether to review fundamentals by looking at what you can explain: subscriptions, resource groups, identity, and basic networking. If those concepts remain unclear, work through them before tackling administrative tasks that combine several services.

How are the AZ-104 objectives weighted?

The April 17, 2026 objectives specify identity/governance 20–25%, storage 15–20%, compute 20–25%, networking 15–20%, and monitoring 10–15%. Use these ranges to check your study coverage. They are not fixed question counts or a formula for calculating your score.

When can you retake AZ-104 after failing?

Microsoft requires 24 hours after the first failure and 14 days after the second and subsequent failures, with five attempts allowed in 12 months. Before booking again, turn unresolved topics into specific practice tasks you can complete and explain.

How should you choose a certification after AZ-104?

Start with the work you want to do next: architecture, delivery automation, security, or deeper administration. Compare the relevant certifications against those tasks, then check each target’s current official requirements. Your next step should address a useful skill gap rather than follow an assumed sequence.

How should you study for AZ-104?

Choose an objective from the published AZ-104 exam objectives and try an original practice question on that topic. Read the answer explanation, then check anything that remains unclear against Microsoft documentation. Where practical, test the configurations yourself to see how the settings affect behavior. The linked study guide gives you a structured approach to organizing your study. Read the AZ-104 study guide

One certification, 12 months

Practice for AZ-104

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy AZ-104 access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →