Home / Flashcard library / Careers & certifications / Microsoft Azure Administrator (AZ-104) / Practice Questions

Careers & certifications

Azure Administrator (AZ-104) — Practice Questions flashcards

6 of 60 questions free to study here · 5 topics · the whole deck is built into Willys

Multiple-choice practice questions, one best answer each, on Entra ID, RBAC, Azure Policy, storage, VMs, App Service, containers, virtual networking, monitoring and backup.

Get the app All Microsoft Azure Administrator (AZ-104) decks

Practice deck · part of Microsoft Azure Administrator (AZ-104) · written against: AZ-104 skills measured (current study guide). Updated 2026-10-10.

Study the free sample

6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 6 sample questions as a list
  1. Users should join and leave a Marketing group automatically whenever the department attribute on their Microsoft Entra ID account changes. What should the administrator create?

    A) An administrative unit that scopes a helpdesk role to marketing users
    B) A group with the Dynamic User membership type and a membership rule
    C) An assigned group with group-based licensing for the marketing licence
    D) An assigned group updated each week with a bulk member upload
    B) A group with the Dynamic User membership type and a membership rule

    A dynamic membership group evaluates a rule such as user.department equals Marketing and adds or removes members as the attribute changes; it needs Microsoft Entra ID P1 or higher. An assigned group, however it is refreshed, still depends on someone changing its members.
    Identities and Governance › Entra Users and Groups
  2. An administrator creates a cloud-only user and tries to assign a Microsoft 365 licence. The assignment fails even though unassigned licences remain in the tenant. Which user property should be set first?

    A) Usage location
    B) Department
    C) Office location
    D) Manager
    A) Usage location

    The usage location must be set before a licence can be assigned, because not every service is offered in every country. The other attributes are optional profile data and do not block licensing.
    Identities and Governance › Entra Users and Groups
  3. A workload needs premium, low-latency SMB file shares in Azure Files. Which type of storage account should the administrator create?

    A) A standard general-purpose v2 account using ZRS
    B) A standard general-purpose v2 account using GRS
    C) A premium block blobs (BlockBlobStorage) account
    D) A premium file shares (FileStorage) account
    D) A premium file shares (FileStorage) account

    Premium file shares require a FileStorage account. Standard general-purpose v2 accounts offer only standard-tier file shares, whatever redundancy they use.
    Storage › Storage Accounts and Redundancy
  4. A resource group contains two VMs and a storage account. An administrator deploys a template that defines only the storage account, using Complete mode. What happens to the VMs?

    A) They are moved to a resource group the deployment creates
    B) They are deallocated but kept in the resource group
    C) They are deleted because the template does not define them
    D) They are left unchanged because unlisted resources are ignored
    C) They are deleted because the template does not define them

    Complete mode deletes resources in the group that the template does not mention. Incremental mode, the default, would have left them alone.
    Watch out: Microsoft now advises against Complete mode and plans to phase it out; deployment stacks are its suggested route for removing resources through a deployment.
    Compute › ARM Templates and Bicep
  5. Spoke1 and Spoke2 are each peered with a hub VNet, but VMs in Spoke1 cannot reach VMs in Spoke2. The address spaces do not overlap and no firewall is used. What should the administrator do?

    A) Put both spokes' VMs in one application security group
    B) Enable Allow gateway transit on both hub peerings
    C) Peer Spoke1 directly with Spoke2
    D) Delete and recreate the hub peerings in reverse order
    C) Peer Spoke1 directly with Spoke2

    VNet peering is non-transitive, so traffic does not pass through the hub automatically. Direct peering, or a hub firewall or NVA with user-defined routes, fixes it; gateway transit only shares the hub's VPN or ExpressRoute gateway.
    Virtual Networking › VNets Peering and Routing
  6. VMs must send performance counters and Windows event logs to a Log Analytics workspace using the current agent. What should the administrator configure?

    A) The Azure Monitor Agent with a data collection rule
    B) The MARS agent registered to a vault
    C) A diagnostic setting on each VM resource sending to the workspace
    D) An action group that targets the workspace
    A) The Azure Monitor Agent with a data collection rule

    The Azure Monitor Agent collects guest data, and a data collection rule says what to collect and where to send it. Diagnostic settings route a resource's platform logs and metrics.
    Monitoring and Maintenance › Azure Monitor and Alerts

Unlock the whole deck

You are studying a free 6-question sample. All 60 questions of Azure Administrator (AZ-104) — Practice Questions, the other 2 Microsoft Azure Administrator (AZ-104) decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More Microsoft Azure Administrator (AZ-104) decks

Identity, Governance and StorageCompute, Networking and Monitoring

← All Microsoft Azure Administrator (AZ-104) decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

  • Checked against the Microsoft Azure Administrator (AZ-104) skills outline — topic outline only; no text copied.
  • Checked against Microsoft Learn documentation for Microsoft Entra ID, Azure RBAC, Azure Policy, resource locks, Cost Management, Azure Storage, Azure Files, Azure File Sync, AzCopy, Azure Resource Manager, Bicep, Azure Virtual Machines, App Service, Azure Container Instances, Azure Container Apps, Azure Virtual Network, Azure DNS, Azure load balancing, Azure Monitor, Network Watcher, Azure Backup and Azure Site Recovery (reference only; no sentences reproduced).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Microsoft and Azure are trademarks of the Microsoft group of companies. This product is not affiliated with, sponsored by, or endorsed by Microsoft.

Use of these pages is covered by our Terms of Use.