Microsoft certification practice
Practise AZ-104 AZ-104 practice test — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps. Microsoft certification exams often test whether you can choose the right Azure, Microsoft 365, identity, security or monitoring action for a realistic administrative scenario. Courseiva helps you practise with structured questions and explanations.
New here? Start with this
Recommended: 10-question diagnostic
Covers all 5 domains · takes ~5 min · no account needed · shows your weak areas immediately
Key facts for the AZ-104 exam.
Exam cost
$165 USD / ~£135
Duration
120 minutes
Question count
40–60 questions
Passing score
700 / 1000
Validity
Annual renewal (free online assessment on Microsoft Learn)
Delivered by
Pearson VUE
Online proctored
Yes — available
Retake policy
100% free — no account required
Everything on Courseiva for AZ-104 is free — no subscription, no trial, no email wall.
Courseiva provides free AZ-104 practice questions with original exam-style questions, detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics. Courseiva is an independent platform and is not affiliated with Microsoft.
24 hours after first failure; 14 days after second
Question formats
Microsoft Azure Administrator (AZ-104) validates skills in managing Azure subscriptions, implementing storage, deploying virtual machines, configuring virtual networking, and managing Azure Active Directory (Entra ID). It is the most widely held Azure Associate certification and is required as a prerequisite for AZ-305.
Official prerequisite
None
Recommended experience
AZ-900 and 6 months hands-on Azure administration experience
6–12 months administering Azure workloads. Should be comfortable with Azure portal, Azure CLI/PowerShell, and core services (VMs, storage, networking, Entra ID).
Should you skip this exam?
If you primarily develop applications on Azure, AZ-204 is a better fit. AZ-104 is for operations and administration, not development.
Courseiva study tip
Case study questions are unique to Microsoft exams and require reading a multi-page business scenario before answering. Practise the case study format specifically — the time pressure is real.
UK salary range
£45,000–£75,000
US salary range
$75,000–$115,000
Job roles that cite AZ-104
Not primarily. AZ-104 covers Azure administration: virtual machines, virtual networking, storage accounts, Entra ID (Azure AD), subscriptions, and monitoring. Azure Functions and Logic Apps are covered mainly in AZ-204 (Azure Developer Associate). Azure DevOps Pipelines are covered in AZ-400 (DevOps Engineer Expert). AZ-104 does touch on Azure Automation, Azure Monitor, and basic integration concepts, but if your role involves building serverless apps or CI/CD pipelines, AZ-204 or AZ-400 is the more relevant certification.
$165 USD.
700 out of 1000.
AZ-104 requires annual renewal via a free online assessment on Microsoft Learn. It does not require re-taking the paid exam annually.
AZ-104 is moderately difficult. It has a wide scope (identity, storage, compute, networking, monitoring) and uses case study questions that add time pressure. Allow 100–200 hours of study and complement with hands-on Azure lab work.
Both are mid-level cloud certs with high market value. SAA-C03 has more demand globally due to AWS's market share. AZ-104 is the right choice if your role is Azure-focused.
Yes. AZ-104 (or its equivalent) is an official prerequisite for AZ-305 (Azure Solutions Architect Expert).
Azure Administrator roles in the UK typically pay £45,000–£75,000. In the US, $75,000–$115,000.
Practice modes
Choose a mode that matches your current study phase. Use topic practice early on and mock exams closer to your exam date.
All AZ-104 Questions
Browse the full question bank organised by domain and difficulty.
Practice Test
Start a session with detailed answer explanations after each question.
Mock Exam
Simulate the real exam with a timed, full-length question set.
Quick 10
A 10-question warm-up — ideal for a short daily study session.
Flashcards
Reinforce key terms, commands, and protocol facts with flashcards.
Domain Practice
Focus exclusively on one exam domain to target your weakest area.
50-Question Set
Mid-length practice set covering all domains.
Full-length Simulation
Full exam simulation matching the real question count.
Exam guide
Start with a short practice session, review each missed answer, then return to the topics that caused mistakes.
AZ-104 questions test whether you can apply the concept in context, not just recognise a definition.
How the topic appears in realistic exam-style scenarios.
Which detail in the question changes the correct answer.
How to eliminate plausible but wrong options.
How to connect the question back to the wider exam objective.
Related practice questions
Use these internal links to move from the exam guide into focused topic practice pages.
Practise AZ-104 questions linked to Manage Azure Identities and Governance.
Practise AZ-104 questions linked to Implement and Manage Storage.
Practise AZ-104 questions linked to Deploy and Manage Azure Compute.
Practise AZ-104 questions linked to Implement and Manage Virtual Networking.
Practise AZ-104 questions linked to Monitor and Maintain Azure Resources.
Practise AZ-104 questions linked to AZ-104 Azure RBAC.
Practise AZ-104 questions linked to AZ-104 storage account.
Practise AZ-104 questions linked to AZ-104 virtual network.
Practise AZ-104 questions linked to AZ-104 NSG.
Practise AZ-104 questions linked to AZ-104 Azure Monitor.
Practise AZ-104 questions linked to AZ-104 backup.
Practise AZ-104 questions linked to AZ-104 managed identity.
Practice directory
Every practice set is a unique selection of questions — numbered tests, domain-focused sessions, and topic-specific quizzes.
Showing 30 of 72 tests. See all 72 AZ-104 practice tests →
Timed mode
Official blueprint
Target weak areas by practising questions from a single domain. Each domain page shows all questions, difficulty breakdown, and a focused practice session.
Practise AZ-104 questions in this domain →
Practise AZ-104 questions in this domain →
Practise AZ-104 questions in this domain →
Practise AZ-104 questions in this domain →
Practise AZ-104 questions in this domain →
Term reference
These terms appear frequently in AZ-104 questions. Understanding them precisely reduces guessing and improves scores.
Dynamic route
A route that is automatically learned and updated by a router using a routing protocol, rather than being manually configured.
Reader role
A Reader role is a predefined set of permissions in identity and governance systems that allows a user to view resources and data but not create, modify, or delete anything.
Security pillar
The Security pillar is a set of best practices for designing and operating cloud systems that protect data, systems, and assets through confidentiality, integrity, and availability controls.
Guest user
A guest user is a temporary or limited-access account that allows someone to use a system, network, or application without full user privileges and often without a permanent identity.
Azure Load Balancer
Azure Load Balancer is a cloud service that evenly distributes incoming network traffic across multiple virtual machines or resources to ensure reliability and high availability.
Public IP address
A globally unique IP address assigned to a device that allows it to communicate directly over the internet.
Soft delete
A soft delete marks data as deleted without actually removing it from the database, allowing recovery if needed.
Risk acceptance
Risk acceptance is a risk management strategy where an organization acknowledges a potential risk but decides to tolerate it without taking active measures to reduce or eliminate it.
Free study guide
The Courseiva AZ-104 study guide covers exam format, the official domain blueprint with weights, a structured study plan, and domain-specific tips for each section. Use it alongside practice questions to build both conceptual depth and exam confidence.
Sample questions
Select your answer before revealing the explanation. These questions are original exam-style — not copied from any exam or dump site.
Trap 1: Assign Storage Account Contributor at the resource group scope.
This grants management-plane control over the storage account and is much broader than needed.
Trap 2: Assign Reader and give the service principal a storage account…
This introduces stored credentials and does not follow the Entra-based least-privilege requirement.
Trap 3: Assign Contributor at the subscription scope and restrict access…
Naming conventions do not enforce security, and subscription scope is unnecessarily broad.
Assign Storage Account Contributor at the resource group scope.
Why wrong: This grants management-plane control over the storage account and is much broader than needed.
Create a custom role with blob dataActions only and assign it at the container scope.
This allows data access while avoiding storage account management permissions and limiting scope.
Assign Reader and give the service principal a storage account access key.
Why wrong: This introduces stored credentials and does not follow the Entra-based least-privilege requirement.
Assign Contributor at the subscription scope and restrict access with naming conventions.
Why wrong: Naming conventions do not enforce security, and subscription scope is unnecessarily broad.
Trap 1: Create a route table that sends RDP traffic to the management…
Route tables do not implement port-based access control.
Trap 2: Deploy a private endpoint for each application server.
Private endpoints are for Azure PaaS services, not exposing VM RDP selectively.
Trap 3: Enable service endpoints on the application subnet.
Service endpoints are unrelated to RDP access control.
Create an NSG rule allowing TCP 3389 from the Subnet-Mgmt address range and rely on the default deny afterward.
This is the correct way to permit RDP from a specific source while denying other sources.
Create a route table that sends RDP traffic to the management subnet.
Why wrong: Route tables do not implement port-based access control.
Deploy a private endpoint for each application server.
Why wrong: Private endpoints are for Azure PaaS services, not exposing VM RDP selectively.
Enable service endpoints on the application subnet.
Why wrong: Service endpoints are unrelated to RDP access control.
Trap 1: Azure Backup vault names
Vault names are configuration details, not a log type that can be queried.
Trap 2: Virtual network address spaces
Address spaces describe networking, but they are not log records for analysis.
Trap 3: Managed disk size settings
Disk size is a resource property, not a log stream for Log Analytics.
Activity log entries
Activity logs record subscription-level events such as create, update, and delete operations.
Resource diagnostic logs
Diagnostic logs capture service-specific events and can be sent to a workspace.
Azure Backup vault names
Why wrong: Vault names are configuration details, not a log type that can be queried.
Virtual network address spaces
Why wrong: Address spaces describe networking, but they are not log records for analysis.
Managed disk size settings
Why wrong: Disk size is a resource property, not a log stream for Log Analytics.
Azure portal > Service Health Incident: Azure Virtual Machines Region: East US Status: Active incident Impact: Some customers may experience failed VM start operations Recommended action: Monitor the incident for updates and mitigation status.
Trap 1: Resource Health, because it shows whether a specific virtual…
Resource Health is focused on the status of an individual resource. It is useful for one VM, but not for tracking a broader regional Azure service incident.
Trap 2: Activity Log, because it lists every administrative action taken in…
Activity Log records control-plane events such as create, update, and delete operations. It does not provide official incident status for Azure platform outages.
Trap 3: Azure Advisor, because it gives recommendations to improve the…
Azure Advisor provides optimization recommendations and best practices. It does not monitor live Microsoft service incidents or outage notifications.
Service Health, because it reports Azure platform incidents that affect customers in a region.
Service Health is the right source for official Azure platform incidents and advisories. It tells administrators when a Microsoft-managed service is having a regional or global issue that may affect their resources.
Resource Health, because it shows whether a specific virtual machine is healthy or unavailable.
Why wrong: Resource Health is focused on the status of an individual resource. It is useful for one VM, but not for tracking a broader regional Azure service incident.
Activity Log, because it lists every administrative action taken in the subscription.
Why wrong: Activity Log records control-plane events such as create, update, and delete operations. It does not provide official incident status for Azure platform outages.
Azure Advisor, because it gives recommendations to improve the virtual machine configuration.
Why wrong: Azure Advisor provides optimization recommendations and best practices. It does not monitor live Microsoft service incidents or outage notifications.
Trap 1: A shared local account on the VM
A local account helps with operating system access, but it does not securely authenticate to Azure APIs.
Trap 2: An Azure Policy exemption
Policy exemptions affect governance rules, not authentication for scripts or Azure resource creation.
Trap 3: A public IP address on the VM
A public IP affects network reachability, but it does not replace Azure authentication credentials.
A shared local account on the VM
Why wrong: A local account helps with operating system access, but it does not securely authenticate to Azure APIs.
A system-assigned managed identity on the VM
A managed identity lets the VM authenticate to Azure directly, so the script can use Azure CLI or PowerShell without secrets.
An Azure Policy exemption
Why wrong: Policy exemptions affect governance rules, not authentication for scripts or Azure resource creation.
A public IP address on the VM
Why wrong: A public IP affects network reachability, but it does not replace Azure authentication credentials.
Trap 1: az login with a username and password.
A username and password requires credential storage and is not appropriate for secretless automation.
Trap 2: Connect-AzAccount with device code authentication.
Device code authentication is interactive and not suitable for unattended nightly automation on a VM.
Trap 3: An app registration secret stored in a PowerShell variable.
A secret in a variable is still a secret on the machine and violates the stated security requirement.
az login with a username and password.
Why wrong: A username and password requires credential storage and is not appropriate for secretless automation.
az login --identity.
The Azure CLI can sign in with the VM's managed identity by using az login --identity. That allows the script to authenticate without storing a password or client secret. After sign-in, the identity can be granted access to the target subscription or resource group, which makes the solution both secure and automation-friendly for nightly jobs.
Connect-AzAccount with device code authentication.
Why wrong: Device code authentication is interactive and not suitable for unattended nightly automation on a VM.
An app registration secret stored in a PowerShell variable.
Why wrong: A secret in a variable is still a secret on the machine and violates the stated security requirement.
Official booking and top-rated study resources for the AZ-104.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.