Associate-level certification covering administration of Azure identities, storage, compute, networking, and monitoring, with a worked explanation on every practice question.
Free sample questions
No account needed. Every question has a worked explanation, just like the full bank.
lock_openFree sampleManage Azure Identities and Governancehard
A resource has both a role assignment granting a user access and a deny assignment that applies to the same user and action. When Azure Resource Manager evaluates the request, the role assignment is checked first and grants access, so the deny assignment is ignored. Is this statement correct?
- AYes
- BNocheck_circle Correct
Deny assignments are evaluated first and override role assignments. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments. Deny assignments take precedence, so the request is blocked, not allowed.
Why A is wrong: Answering Yes assumes role assignments are checked first and win, but the grounding gives deny assignments precedence and evaluates them before role assignments.
Why B is correct: Correct. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments.
lock_openFree sampleManage Azure Identities and Governancemedium
An administrator needs to let a teammate fully manage all resources in the prod-rg resource group, including creating and deleting virtual machines, but the teammate must not be able to assign roles to other users at that scope. Which built-in role should the administrator assign at the resource group scope?
- AContributorcheck_circle Correct
- BOwner
- CReader
- DUser Access Administrator
Contributor manages all resources but cannot assign roles; Owner is Contributor plus role assignment. The grounding states Contributor grants full access to manage all resources but cannot assign roles in Azure RBAC, while Owner grants full management and can also assign roles. The requirement is full management without role-assignment, which is exactly Contributor.
Why A is correct: Correct. The grounding states Contributor grants full access to manage all resources but cannot assign roles in Azure RBAC, while Owner grants full management and can also assign roles.
Why B is wrong: Owner also grants full management of all resources, which is tempting, but Owner adds the ability to assign roles in Azure RBAC. That extra capability is exactly what the requirement forbids.
Why C is wrong: Reader is a low-privilege role that can view resources but cannot change them, so it cannot create or delete the virtual machines the teammate needs to manage.
Why D is wrong: User Access Administrator manages user access and can assign roles, including Owner, but it is centred on access management rather than full resource management, and it grants the role-assignment ability the requirement forbids.
lock_openFree sampleManage Azure Identities and Governancemedium
An administrator wants to manually add a specific user to a group that uses dynamic membership. Statement: An administrator can manually add or remove a member of a dynamic membership group. Is this statement correct?
- AYes
- BNocheck_circle Correct
Dynamic group membership is rule-driven only, so members cannot be added or removed by hand. No is correct because membership of a dynamic membership group is computed automatically: the system evaluates the rule when attributes change and adds users who satisfy it or removes those who no longer do. The documentation states you can't manually add or remove a member of such a group, so a manual add is not possible.
Why A is wrong: The documentation states you can't manually add or remove a member of a dynamic membership group; membership is determined solely by whether the user satisfies the rule. To include the extra person, the rule must change or the user's attributes must match it.
Why B is correct: Correct. No is correct because membership of a dynamic membership group is computed automatically: the system evaluates the rule when attributes change and adds users who satisfy it or removes those who no longer do.
Frequently asked questions
- How many questions are on the AZ-104 exam?
- The Microsoft Azure Administrator (AZ-104) (AZ-104) exam has Typically 40 to 60 questions questions and runs for 120 minutes. The format is multiple choice, multiple response, and case studies, at a pearson vue testing center or online proctored.
- What score do I need to pass AZ-104?
- The pass mark is 700 / 1000. Examworthy gives you a per-domain readiness score so you can see which domains are holding you back before you book.
- How much does the AZ-104 exam cost?
- The exam costs 165 USD to sit. Practising on Examworthy is free to start, with a worked explanation on every question.
- How does Examworthy help me prepare for AZ-104?
- Every practice question carries a worked explanation and a per-distractor rationale, mapped to the official blueprint domains. You learn why each answer is right or wrong, not just the letter.
- Is Examworthy affiliated with Microsoft?
- No. Examworthy is not affiliated with or endorsed by Microsoft. Our questions are original, blueprint-aligned practice material; we never reproduce live exam items.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. AZ-104 and related marks belong to their respective owners.
