Free Microsoft AZ-104 (Azure Administrator) practice test

Microsoft AZ-104 (Azure Administrator Associate) validates that you can manage Azure identities and governance, storage, compute resources, virtual networking, and monitoring. This site gives you 312 original practice questions plus 12 drag-and-drop and matching items in Microsoft's own interactive formats, free and without an account.

The simulator runs 100 timed minutes on the real scale (pass line 700 of 1,000), grades interactive items all-or-nothing the way Microsoft does, and links every topic to the matching chapter of John Savill's free AZ-104 study video.

What AZ-104 covers

AZ-104 domainExam weightQuestions here
Manage Azure identities and governance24%about 75
Implement and manage storage19%about 59
Deploy and manage Azure compute resources24%about 75
Implement and manage virtual networking19%about 59
Monitor and maintain Azure resources14%about 44

Real exam facts: typically 40-60 questions, about 100 minutes, scaled to 1,000 with a 700 pass line. Hands-on Azure administration experience is assumed.

Practice questions from this bank

Sample question 1 · AZ-104 · Manage Azure identities and governance

An administrator must create a group that also provisions a shared mailbox and a SharePoint site for a project team. Which group type meets this need?

  1. AMail-enabled security group
  2. BMicrosoft 365 group
  3. CSecurity group
  4. DDistribution list
Show answer and explanation

B. Microsoft 365 group

Microsoft 365 groups provide a shared mailbox, calendar, and SharePoint site for collaboration. A security group only manages access to resources and does not create a mailbox.

Topic: John Savill AZ-104 Study Cram v2: Users

Sample question 2 · AZ-104 · Implement and manage storage

An administrator sets the storage firewall default action to Deny. Which rule still allows traffic from a specific subnet?

  1. AA public access level of Container set on the subnet
  2. BA Storage Blob Data Reader assignment on the subnet identity
  3. CA stored access policy that grants the subnet blob read access
  4. DA virtual network rule tied to the subnet's service endpoint
Show answer and explanation

D. A virtual network rule tied to the subnet's service endpoint

A VNet rule paired with the Microsoft.Storage service endpoint on the subnet passes the firewall. Stored access policies and RBAC roles do not affect network-level firewall decisions.

Topic: John Savill AZ-104 Study Cram v2: Storage Accounts (firewalls)

Sample question 3 · AZ-104 · Deploy and manage Azure compute resources

An administrator reviews a Bicep file containing the line output storageId string = stg.id. What does declaring this output accomplish?

  1. AIt defines a required value the caller must supply before deployment
  2. BIt prevents the storage account from being deleted after deployment
  3. CIt creates a new storage account named stg during the deployment
  4. DIt returns the storage account resource ID for reuse by other deployments
Show answer and explanation

D. It returns the storage account resource ID for reuse by other deployments

Outputs surface values such as a resource ID after deployment for reuse by scripts or parent modules. A value the caller supplies is a parameter, and outputs neither create resources nor apply delete locks.

Topic: John Savill AZ-104 Study Cram v2: Provisioning Resources

Sample question 4 · AZ-104 · Implement and manage virtual networking

When an administrator creates a subnet in an Azure virtual network, how many IP addresses does Azure reserve and make unavailable for resources?

  1. ATwo
  2. BThree
  3. CFive
  4. DOne
Show answer and explanation

C. Five

Azure reserves five addresses in every subnet: the network address, the default gateway, two for Azure DNS mapping, and the broadcast address, so a /24 yields 251 usable addresses.

Topic: John Savill AZ-104 Study Cram v2: Virtual Network

Sample question 5 · AZ-104 · Monitor and maintain Azure resources

An administrator wants to view near real-time CPU utilization for a virtual machine over the last hour at one-minute granularity. Which Azure Monitor tool should they open?

  1. AService Health
  2. BActivity log
  3. CLog Analytics workspace
  4. DMetrics Explorer
Show answer and explanation

D. Metrics Explorer

Metrics Explorer plots platform metrics such as Percentage CPU in near real-time at one-minute granularity. Log Analytics is for query-based log data, not the default numeric metric stream.

Topic: John Savill AZ-104 Study Cram v2: Monitoring

Sample question 6 · AZ-104 · Manage Azure identities and governance

An administrator changes a group's membership type from Assigned to Dynamic. What happens to the members that were added manually?

  1. AMembers keep their access permanently
  2. BMembers are converted into group owners
  3. CMembers are removed and rebuilt from the rule
  4. DMembers are copied into a new group
Show answer and explanation

C. Members are removed and rebuilt from the rule

Switching to dynamic membership discards manually assigned members and rebuilds the group from the rule. Only objects matching the rule remain in the group.

Topic: John Savill AZ-104 Study Cram v2: Groups

Sample question 7 · AZ-104 · Implement and manage storage

An ad hoc SAS that is not tied to any policy leaks before it expires. What is the fastest way to invalidate that token?

  1. ARegenerate the account key that signed it
  2. BLower the signed expiry value in the token
  3. CRemove the user delegation key from Entra ID
  4. DDelete the stored access policy it references
Show answer and explanation

A. Regenerate the account key that signed it

An ad hoc SAS is signed by an account key, so rotating that key invalidates every SAS it produced. There is no policy to delete, and an issued token's fields cannot be edited.

Topic: John Savill AZ-104 Study Cram v2: Storage Accounts (SAS)

Sample question 8 · AZ-104 · Deploy and manage Azure compute resources

An administrator runs a template deployment and wants a preview of exactly which resources will change before committing. Which option should be used?

  1. AThe complete deployment mode flag on the command
  2. BThe what-if operation on the deployment command
  3. CThe no-wait parameter on the command
  4. DThe rollback-on-error switch on the command
Show answer and explanation

B. The what-if operation on the deployment command

what-if previews the changes a deployment would make without applying them. Complete mode governs deletion of unlisted resources, rollback reverts to a prior deployment, and no-wait only returns control early.

Topic: John Savill AZ-104 Study Cram v2: Deploy with ARM/Bicep

Common questions

How many questions are on the AZ-104 exam?

AZ-104 typically has 40 to 60 questions in about 100 minutes, including multiple choice, multiple response, and drag-and-drop, sometimes with a case study. Passing requires 700 on a scale up to 1,000.

Do I need AZ-900 before AZ-104?

No. AZ-900 (Fundamentals) is a helpful primer but is not required. AZ-104 is the associate-level exam and assumes hands-on Azure administration experience.

What does AZ-104 cover?

Five areas: manage identities and governance (20-25%), implement and manage storage (15-20%), deploy and manage compute (20-25%), implement and manage virtual networking (15-20%), and monitor and maintain resources (10-15%). Our drills track your accuracy in each separately.

Is this actually free?

Yes. Every question, every interactive item, and the exam simulator are free with no account. Every topic links to the matching chapter of John Savill's free AZ-104 study video.

More free practice tests

Back to all cert900 exams