Microsoft · Free Practice Questions · Last reviewed May 2026
30real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
24% of exam · 6 sample questions below
Your company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?
Assign the custom role to VMOperators at the subscription scope.
Assign the custom role to VMOperators at the RG-Prod scope.
Assigning the custom role at the RG-Prod resource group scope ensures the Microsoft.Compute/virtualMachines/restart/action permission applies only to VMs within that resource group. This follows the principle of least privilege because VMOperators receive exactly the restart capability and nothing else, with no ability to influence resources in other resource groups or subscriptions. The role assignment is scoped specifically to the resource group to support the business requirement for production VMs only.
Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.
Assign the custom role to VMOperators at the management group scope.
Your organization assigns an Azure Policy at the Corp-MG management group to require the tag Environment on all newly created resources. A deployment to RG-App in the Prod-Sub subscription fails because the tag is missing. You need to allow this single deployment to proceed without weakening enforcement for the rest of the organization. What should you do?
Remove the policy assignment from Corp-MG.
Create a policy exemption at the Prod-Sub or RG-App scope.
Creating a policy exemption at the Prod-Sub or RG-App scope is the correct remediation because exemptions are scoped to specific resources, resource groups, or subscriptions and instruct Azure Policy to skip evaluation for those resources while the policy assignment remains intact and enforced everywhere else. When you create the exemption, you must select an exemption category (Waiver or Mitigated) and can optionally set an expiration date, which provides audit traceability for why the deployment is allowed. This preserves the original Deny effect for all other child scopes of Corp-MG, so the broader governance model is maintained without weakening security or compliance posture.
Change the policy effect from Deny to Audit for all assignments.
Move Prod-Sub out of Corp-MG.
You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?
A Microsoft Entra group and a single role assignment to the group.
A Microsoft Entra group gives you a single identity object that can be scoped to a management group, subscription, or resource group. Assigning the RBAC role once to that group means all 15 administrators inherit the same permissions automatically, and future access changes are made by editing group membership rather than adding or removing individual role assignments. This supports least privilege and simplifies audits because the role assignment, role definition, and scope are all explicit.
A separate custom role assignment for each administrator.
A resource lock on every virtual machine.
A policy exemption for the administrators.
A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?
A CanNotDelete lock on stfinance01.
A CanNotDelete lock on the storage account scope blocks all Azure Resource Manager Delete calls against stfinance01 from any principal, even an Owner, until the lock is explicitly removed. This preserves the resource while leaving the control-plane and data-plane APIs open for permitted write updates, making it the right balance for critical data. The lock must be removed before deletion can succeed, creating an intentional two-step safeguard.
A ReadOnly lock on stfinance01.
A policy assignment that audits storage accounts.
An NSG rule denying outbound traffic from the subnet.
Your company has two subscriptions named Dev-Sub and Prod-Sub. A new administrator must be able to create resource groups only in Dev-Sub and must not have any permissions in Prod-Sub. What should you do?
Assign Contributor to the administrator at the management group scope.
Assign Contributor to the administrator at the Dev-Sub scope.
Assigning Contributor at the Dev-Sub subscription scope grants the administrator permission to create and manage all resource types within that subscription, including resource groups and any resources inside them, without granting access to other subscriptions. Contributor deliberately excludes the 'Manage Access' permission, so the administrator cannot delegate roles to others, aligning with the principle of least privilege. This scope exactly matches the requirement to administer Dev resources, and because the role assignment is scoped to the subscription, it cannot affect Prod-Sub or any other Azure scope.
Assign Owner to the administrator at the resource group scope in Dev-Sub.
Assign Reader to the administrator at the Prod-Sub scope and Contributor at the tenant root group.
Your organization requires all storage accounts to allow access only from selected networks. You need a governance solution that automatically corrects noncompliant new storage accounts when possible instead of only reporting them. What policy effect should you choose?
Audit
Disabled
DeployIfNotExists
DeployIfNotExists is the correct effect because it actively deploys a required configuration—such as a network rule or Service Endpoint—when the policy engine detects that a storage account is noncompliant. This effect supports automatic remediation by triggering a deployment task that brings the resource into compliance without manual intervention, making it the only listed effect that both identifies and fixes the misconfiguration.
Append
Want more Manage Azure Identities and Governance practice?
Practice this domain19% of exam · 6 sample questions below
Your company stores departmental documents in an Azure file share. Users need to be able to recover previous versions of files that were deleted or modified accidentally. You need a solution that supports recovery at the file share level without deploying additional virtual machines. What should you configure?
Enable blob versioning.
Configure Azure File Sync cloud tiering.
Create share snapshots for the Azure file share.
Share snapshots provide point-in-time recovery for Azure Files without adding extra infrastructure.
Enable immutable blob storage.
A business-critical application uses an Azure storage account. The company requires that data remain available even if an entire Azure region becomes unavailable. Which redundancy option should you choose?
LRS
ZRS
GRS
GZRS
GZRS (Geo-Zone-Redundant Storage) is correct because it synchronously replicates your data across three Azure availability zones in the primary region, and then asynchronously replicates to a secondary region. This gives you both multi-zone protection against complete zone failures and geo-redundancy against a full regional outage. For a business-critical application that must tolerate both local area disruptions and a datacenter/region-level disaster, GZRS is the only storage redundancy option that satisfies both requirements simultaneously.
A partner needs temporary read-only access to a single blob in a storage account for the next 24 hours. The partner must not be able to list other blobs or write data. What should you provide?
The storage account access key.
A service SAS scoped to the blob with read permission and an expiry time.
A service SAS is a signed URI that grants time-limited, delegated access to a specific storage resource. Scoping it to the exact blob and setting only the read permission (and an expiry) follows the least-privilege model: the partner can read only that object, only for the window you define, and no other storage resources are exposed. Because the SAS token is embedded in the URL, it is ideal for giving temporary, extranet access without requiring the partner to have an Azure identity. The expiry and permission parameters are enforced by the storage service, so access is revoked automatically once the time passes.
A private endpoint to the storage account.
Contributor access to the storage account.
You have a storage account named stlogs01. An application running on VM-App01 in Azure must access blobs in the account without storing account keys in code or configuration files. What should you use?
A shared access signature stored in a text file on VM-App01.
The storage account access key hard-coded in the application.
A managed identity for VM-App01 and Azure RBAC on the storage account.
For the correct approach, configure a system-assigned managed identity on VM-App01 so the application acquires an Azure AD token automatically at runtime, then grant that identity the Storage Blob Data Contributor (or a minimally scoped custom) RBAC role at the storage account or container level. This completely removes secret management because the managed identity is the security principal, tokens are issued by Azure AD, and credentials are rotated automatically. Unlike keys or SAS, there is no embedded secret to leak, and access can be surgically revoked by removing the role assignment—making this the only option that satisfies a strict identity-based, no-secrets security requirement.
Anonymous public access for the blob container.
You need to grant an external partner temporary read access to a single blob in an Azure storage account without giving access to the account key. What should you create?
A storage account access key
A shared access signature (SAS)
A shared access signature (SAS) is the correct choice because you can scope it to a single blob, assign only the Read permission, and set precise start and expiry times. This allows an external partner to access just that one blob for a limited period while keeping the rest of the storage account private. You can also revoke the SAS before expiry or, if you use a user delegation SAS, invalidate the signing key, giving you full control over the temporary grant.
A resource lock
A private endpoint
You have a storage account that stores infrequently accessed data that must remain available immediately when requested. You need to minimize storage costs. Which access tier should you use?
Premium
Hot
Cool
Cool tier is designed for data that is accessed infrequently but requires immediate availability, offering lower storage costs than Hot while keeping negligible retrieval latency. Its access charges are higher, but that is outweighed by the storage savings when reads are sparse, which directly matches the scenario's profile. Therefore Cool is the correct tier because it minimizes idle storage cost without forcing you to rehydrate the data before reading it.
Archive
Want more Implement and Manage Storage practice?
Practice this domain24% of exam · 6 sample questions below
You need to deploy 20 identical Azure virtual machines that host the same web application. The solution must support automatic scale-out based on CPU usage and should minimize administrative overhead. What should you deploy?
20 individual virtual machines in the same resource group.
A Virtual Machine Scale Set.
VM Scale Sets provide a managed group of identical VMs with autoscaling support.
An availability set.
Azure Container Instances.
A virtual machine named VM-App01 hosts a critical internal application. You need to protect the VM so that it can be restored if the VM is deleted or corrupted. The solution must provide centralized backup management and retention policies. What should you use?
Azure Backup with a Recovery Services vault.
Azure Backup with a Recovery Services vault is the correct solution because it provides a centralized, policy-driven backup service designed specifically for VM protection. It installs the VM extension to take application-consistent snapshots, transfers them to the vault, and applies configurable retention rules for daily/weekly/monthly/yearly points. This enables granular restores (files, disks, or entire VM) with integration into Azure Monitor and RBAC, giving you a reliable, auditable backup system for disaster recovery and operational recovery.
Managed disk snapshots only.
Azure Site Recovery only.
Boot diagnostics.
You need to restore a deleted file from a backed-up Azure virtual machine without restoring the entire VM. Which Azure Backup capability should you use?
Cross-region restore
File Recovery
Azure Backup's File Recovery feature is the correct tool because it is specifically designed to restore individual files or folders from an Azure VM backup without redeploying the entire VM. You select a recovery point, and Azure mounts the backup as an iSCSI target on your machine, allowing you to copy the deleted file directly. This granular recovery is efficient for single-file restores and avoids the overhead of a full VM restoration.
Azure Site Recovery failover
Boot diagnostics
You deploy several Windows virtual machines and need to install Microsoft Antimalware on each VM without logging on manually. What should you use?
An NSG application security group.
A VM extension.
A VM extension is the Azure resource-managed mechanism that delivers post-deployment configuration and automation tasks directly inside a Windows guest OS, such as running scripts via Custom Script Extension or applying Desired State Configuration. When you deploy Windows VMs and need to install software or make server-level changes, a VM extension is a supported, idempotent option that Azure tracks in the VM model. Unlike network constructs, extensions execute in the guest and are the correct answer.
A route table.
A blob lifecycle rule.
Your company hosts an internal web app in Azure App Service. Access must be limited to users connecting from the corporate virtual network over private IP addresses only. What should you configure?
An App Service Environment only.
Access restrictions based on public IP ranges only.
A private endpoint for the web app.
A private endpoint for the web app is the correct solution because it assigns the App Service a private IP address from your virtual network, enabling direct and secure access without traversing the public internet. When configured with the 'Deny public access' option, the public endpoint is removed entirely, leaving only the private route from your VNet. This gives you the precise control over connectivity you need while keeping the existing App Service plan.
A public load balancer in front of the web app.
You plan to deploy two virtual machines that run the same line-of-business application. The VMs must remain available during planned maintenance of the Azure platform, but autoscaling is not required. What should you use?
A Virtual Machine Scale Set.
An availability set.
An availability set is the correct, targeted Azure construct for a small fixed set of VMs that must stay up together. When you place both VMs in the same availability set, Azure distributes them across fault domains and update domains, so a single rack failure or a planned maintenance reboot affects only one VM at a time. This meets the high-availability requirement directly and qualifies the deployment for the 99.95% VM SLA. It is simpler and more appropriate than scale-out or container-based alternatives for exactly two VMs running the same line-of-business application.
Azure Container Apps.
A private endpoint.
Want more Deploy and Manage Azure Compute practice?
Practice this domain19% of exam · 6 sample questions below
Which statement best explains why centralized logging is valuable in security operations?
It improves visibility by collecting events from multiple devices in one place for review and investigation.
Centralized logging aggregates syslog messages, Windows Event Logs, Azure Activity Logs, and resource diagnostic logs into a single Log Analytics workspace. This consolidation enables security and operations teams to search, correlate, and investigate events across all devices and workloads without jumping between multiple consoles. Because logs are stored in one queriable repository, incident response and root-cause analysis become significantly faster and more effective.
It guarantees that no unauthorized action can occur.
It replaces the need for NTP and authentication.
It automatically assigns IP addresses to monitoring systems.
Why is centralized logging especially helpful during incident investigation?
It helps investigators analyze related events from multiple devices in one place.
This is correct because centralized collection improves visibility and correlation.
It guarantees that no attack can ever succeed.
It replaces the need for access control.
It forces all devices to use the same VLAN.
Why is centralized logging especially useful during security investigations?
It makes related events from multiple devices easier to review and correlate.
This is correct because centralized visibility is the main investigative benefit.
It guarantees that attacks cannot succeed.
It replaces the need for authentication and authorization.
It forces all devices to use the same VLAN.
Why is centralized logging valuable during security incident response?
It makes related events from many devices easier to collect and correlate.
Centralized logging aggregates events from firewalls, endpoints, servers, and cloud services into a single time-indexed repository, allowing analysts to reconstruct a full attack chain by correlating related activities across devices. Instead of examining isolated logs, investigators can query for indicators of compromise that span an entire network, significantly reducing the time to detect and respond to incidents.
It guarantees that attacks cannot succeed.
It replaces access control mechanisms.
It forces all systems to use one VLAN.
An operations team wants device-generated log messages collected centrally so engineers can review interface changes, warnings, and errors from one place. Which technology is most directly associated with that goal?
Syslog
Syslog is the standard protocol for centralized event and log reporting. It enables network devices, servers, and firewalls to send timestamped event messages—identified by facility and severity levels—over UDP port 514 or TCP 6514 to a central log collector. This allows the operations team to aggregate, filter, and analyze device-generated logs in a single location, making it the correct answer.
NetFlow
DHCP relay
Port security
Which two statements accurately describe the value of centralized DHCP in enterprise networks?
It can reduce the need to maintain separate DHCP servers in every subnet or site.
Centralizing DHCP on a single server or a small cluster eliminates the operational overhead and administrative burden of deploying and patching separate DHCP servers in every physical segment or branch office. Instead of maintaining per-subnet authorization, database backups, and failover configurations across many hosts, admins can manage one service that serves multiple scopes. This simplification lowers hardware and licensing costs and makes consistent DHCP policy enforcement much easier.
It can make address-policy changes easier to manage from a central location.
When DHCP is centralized, IP address range modifications, option settings (like DNS or NTP), and reservation updates are changed once in a central console, rather than duplicated across dozens of remote servers. This reduces configuration drift because every subnet's scope is defined and version-controlled in one place. Centralized monitoring and reporting also let admins quickly identify utilization or conflict issues across the entire network without logging into each site server.
It removes the need for relay across Layer 3 boundaries.
It eliminates the need for default gateways.
It is useful only on wireless networks.
Want more Implement and Manage Virtual Networking practice?
Practice this domain14% of exam · 6 sample questions below
You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?
Create an Azure Monitor metric alert and link it to an action group.
An Azure Monitor metric alert continuously evaluates the VM's platform metric for Percentage CPU (a value emitted by Azure Monitor from the VM's hypervisor) against a defined threshold. When the average CPU usage exceeds the threshold, the alert fires and activates a linked action group, which delivers notifications via email, SMS, webhook, ITSM, or automation runbook. This is the intended mechanism for real-time, metric-based performance alerting on a VM.
Create an Azure Advisor recommendation alert.
Create an activity log alert for the virtual machine.
Create a subscription budget alert.
Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?
A Log Analytics workspace.
A Log Analytics workspace is the correct destination for querying performance and event data because it acts as Azure Monitor's central repository for log data. It ingests activity logs, resource diagnostics, and VM guest metrics, retaining them for customizable retention periods and enabling rich KQL (Kusto Query Language) queries across all collected signals for troubleshooting and analysis.
Azure Advisor.
Azure Network Watcher only.
A network security group.
You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?
Diagnostic settings
Diagnostic settings are the Azure-native mechanism that directs Azure Firewall logs, such as the application, network, and DNS proxy rule logs, to a monitoring destination like a Log Analytics workspace, storage account, or Event Hub. By enabling diagnostic settings, you can set custom retention periods for log retention and use KQL queries for long-term analysis. Without this, the firewall only retains logs for the fixed, brief period defined by the service itself.
A resource lock
An availability set
A VNet peering connection
You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?
A metric alert on CPU percentage
A budget alert
An activity log alert
An activity log alert is purpose-built for Azure control-plane events such as resource-group deletions. The Activity Log records operational events at the subscription level, including the Delete Resource Group operation, and a rule can be configured to fire immediately when that operation occurs. This directly triggers a security-team notification via email, webhook, ITSM, or an action group, making it the correct solution.
A log alert based only on guest OS event logs
Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?
A Log Analytics workspace
A Log Analytics workspace is the Azure Monitor service designed specifically for centralized log retention, indexing, and KQL-based analysis. It ingests telemetry from Azure resources, operating systems, and applications, then stores that data in queryable tables. Running Kusto queries across collected logs requires this workspace as the analytical backend, making it the only valid choice here.
An availability zone
A NAT gateway
A standard public IP address
A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?
Autoscale rules in Azure Monitor
Autoscale rules in Azure Monitor are the native mechanism for automatically adding or removing VM Scale Set instances based on metric thresholds such as CPU percentage, memory pressure, or a custom application metric. A rule defines a metric source, an operator (e.g., greater than), a threshold, and a duration, and when the condition holds, the scale action increments the instance count by a specified value. These rules can also include a cool-down period to prevent flapping, and schedule-based profiles allow time-window scaling. Because the autoscale engine is part of Azure Monitor, it is the correct component to implement metric-driven auto-instance provisioning for a scale set.
A Recovery Services vault policy
Boot diagnostics
Azure Advisor only
Want more Monitor and Maintain Azure Resources practice?
Practice this domainThe AZ-104 exam has 50 questions and must be completed in 120 minutes. The passing score is 700/1000.
Scenario questions on Azure administration covering identities, governance, storage, compute, networking, and monitoring using Azure portal and CLI. Some questions are performance-based (PBQs), asking you to complete tasks in a simulated environment.
The exam covers 5 domains: Manage Azure Identities and Governance, Implement and Manage Storage, Deploy and Manage Azure Compute, Implement and Manage Virtual Networking, Monitor and Maintain Azure Resources. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Microsoft AZ-104 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.