Microsoft · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
20% of exam · 6 sample questions below
Your company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?
Assign the custom role to VMOperators at the subscription scope.
Assign the custom role to VMOperators at the RG-Prod scope.
This applies the permissions only to resources in the RG-Prod resource group and follows least privilege.
Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.
Assign the custom role to VMOperators at the management group scope.
Your organization assigns an Azure Policy at the Corp-MG management group to require the tag Environment on all newly created resources. A deployment to RG-App in the Prod-Sub subscription fails because the tag is missing. You need to allow this single deployment to proceed without weakening enforcement for the rest of the organization. What should you do?
Remove the policy assignment from Corp-MG.
Create a policy exemption at the Prod-Sub or RG-App scope.
A scoped exemption allows the deployment while preserving the broader governance model.
Change the policy effect from Deny to Audit for all assignments.
Move Prod-Sub out of Corp-MG.
A help desk team must be able to reset passwords for cloud users in Microsoft Entra ID, but they must not be able to create or delete users. Which built-in role should you assign?
Global Administrator
User Administrator
This aligns with the least-privilege requirement for user management tasks like password resets.
Reader
Billing Administrator
You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?
A Microsoft Entra group and a single role assignment to the group.
This is the most scalable and maintainable approach.
A separate custom role assignment for each administrator.
A resource lock on every virtual machine.
A policy exemption for the administrators.
A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?
A CanNotDelete lock on stfinance01.
This prevents accidental deletion while allowing permitted write operations.
A ReadOnly lock on stfinance01.
A policy assignment that audits storage accounts.
An NSG rule denying outbound traffic from the subnet.
Your company has two subscriptions named Dev-Sub and Prod-Sub. A new administrator must be able to create resource groups only in Dev-Sub and must not have any permissions in Prod-Sub. What should you do?
Assign Contributor to the administrator at the management group scope.
Assign Contributor to the administrator at the Dev-Sub scope.
This limits the contributor permissions to Dev-Sub, which matches the requirement.
Assign Owner to the administrator at the resource group scope in Dev-Sub.
Assign Reader to the administrator at the Prod-Sub scope and Contributor at the tenant root group.
Want more Manage Azure Identities and Governance practice?
Practice this domain15% of exam · 6 sample questions below
Your company stores departmental documents in an Azure file share. Users need to be able to recover previous versions of files that were deleted or modified accidentally. You need a solution that supports recovery at the file share level without deploying additional virtual machines. What should you configure?
Enable blob versioning.
Configure Azure File Sync cloud tiering.
Create share snapshots for the Azure file share.
Share snapshots provide point-in-time recovery for Azure Files without adding extra infrastructure.
Enable immutable blob storage.
A business-critical application uses an Azure storage account. The company requires that data remain available even if an entire Azure region becomes unavailable. Which redundancy option should you choose?
LRS
ZRS
GRS
GZRS
This best matches the requirement for both zone and region resilience.
A partner needs temporary read-only access to a single blob in a storage account for the next 24 hours. The partner must not be able to list other blobs or write data. What should you provide?
The storage account access key.
A service SAS scoped to the blob with read permission and an expiry time.
This is the least-privilege option for temporary, blob-specific access.
A private endpoint to the storage account.
Contributor access to the storage account.
You have a storage account named stlogs01. An application running on VM-App01 in Azure must access blobs in the account without storing account keys in code or configuration files. What should you use?
A shared access signature stored in a text file on VM-App01.
The storage account access key hard-coded in the application.
A managed identity for VM-App01 and Azure RBAC on the storage account.
This removes secret storage and uses identity-based access.
Anonymous public access for the blob container.
You need to grant an external partner temporary read access to a single blob in an Azure storage account without giving access to the account key. What should you create?
A storage account access key
A shared access signature (SAS)
A SAS provides scoped, time-limited access to the specific blob.
A resource lock
A private endpoint
You have a storage account that stores infrequently accessed data that must remain available immediately when requested. You need to minimize storage costs. Which access tier should you use?
Premium
Hot
Cool
Cool is appropriate for infrequently accessed data that still needs immediate availability.
Archive
Want more Implement and Manage Storage practice?
Practice this domain20% of exam · 6 sample questions below
You need to deploy 20 identical Azure virtual machines that host the same web application. The solution must support automatic scale-out based on CPU usage and should minimize administrative overhead. What should you deploy?
20 individual virtual machines in the same resource group.
A Virtual Machine Scale Set.
VM Scale Sets provide a managed group of identical VMs with autoscaling support.
An availability set.
Azure Container Instances.
A virtual machine named VM-App01 hosts a critical internal application. You need to protect the VM so that it can be restored if the VM is deleted or corrupted. The solution must provide centralized backup management and retention policies. What should you use?
Azure Backup with a Recovery Services vault.
This provides centralized VM protection, retention policies, and restore capabilities.
Managed disk snapshots only.
Azure Site Recovery only.
Boot diagnostics.
You need to restore a deleted file from a backed-up Azure virtual machine without restoring the entire VM. Which Azure Backup capability should you use?
Cross-region restore
File Recovery
This is the feature designed for restoring specific files and folders.
Azure Site Recovery failover
Boot diagnostics
You deploy several Windows virtual machines and need to install Microsoft Antimalware on each VM without logging on manually. What should you use?
An NSG application security group.
A VM extension.
This is the standard mechanism for automated VM guest configuration tasks.
A route table.
A blob lifecycle rule.
Your company hosts an internal web app in Azure App Service. Access must be limited to users connecting from the corporate virtual network over private IP addresses only. What should you configure?
An App Service Environment only.
Access restrictions based on public IP ranges only.
A private endpoint for the web app.
This provides private access from the VNet using a private IP address.
A public load balancer in front of the web app.
You plan to deploy two virtual machines that run the same line-of-business application. The VMs must remain available during planned maintenance of the Azure platform, but autoscaling is not required. What should you use?
A Virtual Machine Scale Set.
An availability set.
This is the classic fit for a small set of highly available VMs.
Azure Container Apps.
A private endpoint.
Want more Deploy and Manage Azure Compute practice?
Practice this domain20% of exam · 6 sample questions below
A network team wants all routers to send log messages to a centralized server at 192.0.2.50. Which command should be added to the router configuration?
snmp-server host 192.0.2.50
archive 192.0.2.50
ntp server 192.0.2.50
logging host 192.0.2.50
This is correct because `logging host` identifies the destination Syslog server.
Which statement best explains the value of enabling both centralized logging and strong access controls on network devices?
Access controls reduce unauthorized use, and centralized logging improves visibility and investigation.
This is correct because the two controls complement each other by combining prevention and monitoring.
Both features do the exact same job, so using both is redundant.
Centralized logging removes the need for any authentication.
Strong access control makes log timestamps irrelevant.
Which statement best explains why centralized logging is valuable in security operations?
It improves visibility by collecting events from multiple devices in one place for review and investigation.
This is correct because centralized collection is the main value of centralized logging.
It guarantees that no unauthorized action can occur.
It replaces the need for NTP and authentication.
It automatically assigns IP addresses to monitoring systems.
Why is centralized logging especially helpful during incident investigation?
It helps investigators analyze related events from multiple devices in one place.
This is correct because centralized collection improves visibility and correlation.
It guarantees that no attack can ever succeed.
It replaces the need for access control.
It forces all devices to use the same VLAN.
Why is centralized logging especially useful during security investigations?
It makes related events from multiple devices easier to review and correlate.
This is correct because centralized visibility is the main investigative benefit.
It guarantees that attacks cannot succeed.
It replaces the need for authentication and authorization.
It forces all devices to use the same VLAN.
Why is centralized logging valuable during security incident response?
It makes related events from many devices easier to collect and correlate.
This is correct because centralized visibility is the main investigative benefit.
It guarantees that attacks cannot succeed.
It replaces access control mechanisms.
It forces all systems to use one VLAN.
Want more Implement and Manage Virtual Networking practice?
Practice this domain25% of exam · 6 sample questions below
You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?
Create an Azure Monitor metric alert and link it to an action group.
This is the standard way to send automated notifications based on CPU thresholds.
Create an Azure Advisor recommendation alert.
Create an activity log alert for the virtual machine.
Create a subscription budget alert.
Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?
A Log Analytics workspace.
This provides centralized collection, retention, and KQL-based querying for Azure Monitor Logs.
Azure Advisor.
Azure Network Watcher only.
A network security group.
You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?
Diagnostic settings
This is the Azure-native mechanism for routing logs and metrics to monitoring destinations.
A resource lock
An availability set
A VNet peering connection
You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?
A metric alert on CPU percentage
A budget alert
An activity log alert
This targets Azure control-plane events such as deletions.
A log alert based only on guest OS event logs
Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?
A Log Analytics workspace
This is the service designed for centralized log retention and KQL-based analysis.
An availability zone
A NAT gateway
A standard public IP address
A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?
Autoscale rules in Azure Monitor
This directly implements metric-based scaling logic for the VM Scale Set.
A Recovery Services vault policy
Boot diagnostics
Azure Advisor only
Want more Monitor and Maintain Azure Resources practice?
Practice this domainThe AZ-104 exam has 50 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario questions on Azure administration covering identities, governance, storage, compute, networking, and monitoring using Azure portal and CLI. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 5 domains: Manage Azure Identities and Governance, Implement and Manage Storage, Deploy and Manage Azure Compute, Implement and Manage Virtual Networking, Monitor and Maintain Azure Resources. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft AZ-104 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.