15 real AZ-104 sample questions, each with an explanation of why every option is right or wrong. No account, no card. This is the reasoning the AZ-104 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real AZ-104 is Typically 40 to 60 questions questions in 120 minutes, pass mark 700 / 1000. For a domain-by-domain breakdown and a study plan, read the AZ-104 study guide. The full bank has 242 questions.
lock_openFree sampleDeploy and Manage Azure Compute Resourcesmedium
An administrator decompiles an ARM template to Bicep and assumes the conversion is guaranteed to produce a one-to-one mapping with no manual fixes ever required. Is this assumption correct?
- AYes
- BNocheck_circle Correct
Decompile is best-effort with no guaranteed JSON-to-Bicep mapping, so manual fixes can be required. The docs caution that decompilation attempts to convert the file but there is no guaranteed mapping from JSON ARM templates to Bicep, and you might need to fix warnings and errors in the generated Bicep file. Decompilation can even fail if an accurate conversion is not possible.
Why A is wrong: Treating decompile as a guaranteed lossless mapping is wrong; the documentation explicitly states there is no guaranteed mapping and that manual fixes for warnings and errors may be needed.
Why B is correct: Correct. The docs caution that decompilation attempts to convert the file but there is no guaranteed mapping from JSON ARM templates to Bicep, and you might need to fix warnings and errors in the generated Bicep file.
lock_openFree sampleDeploy and Manage Azure Compute Resourcesmedium
You deploy an ARM template that defines a storage account with a fixed name and Standard_LRS SKU. A storage account with exactly those properties already exists in the target resource group. What happens when the deployment runs?
- ANo changes are made to the existing storage account because templates are idempotent.check_circle Correct
- BThe deployment fails because a resource with that name already exists in the group.
- CA second storage account is created with a numeric suffix appended to the name.
- DThe existing account is deleted and then recreated from the template values.
Deploying a template whose desired state already exists results in no changes, because templates are idempotent. ARM templates are idempotent: you can deploy the same template many times and get the same resource types in the same state. The docs state that if the storage account with the specified properties already exists, no changes are made.
Why A is correct: Correct. ARM templates are idempotent: you can deploy the same template many times and get the same resource types in the same state.
Why B is wrong: Idempotency means redeploying the same desired state succeeds without error rather than failing on the existing resource.
Why C is wrong: Resource Manager matches on the declared name and type; it does not auto-generate a parallel resource with a suffix.
Why D is wrong: When the declared state already matches, Resource Manager makes no changes rather than tearing down and rebuilding the resource.
lock_openFree sampleDeploy and Manage Azure Compute Resourcesmedium
A workload needs roughly 3 TiB of storage on a single volume. The team plans to put it directly on the VM OS disk, which uses a default master boot record partition. Why will this plan fail to expose the full capacity, and what is the documented maximum capacity of an OS disk?
- AAn MBR limits usable size to 4 TiB, while the OS disk maximum capacity is 2,048 GiB
- BAn MBR limits usable size to 2 TiB, while the OS disk maximum capacity is 4,095 GiBcheck_circle Correct
- CAn MBR limits usable size to 1 TiB, while the OS disk maximum capacity is 4,095 GiB
- DAn MBR limits usable size to 2 TiB, while the OS disk maximum capacity is 32,767 GiB
An OS disk maxes at 4,095 GiB, but a default MBR caps usable size at 2 TiB; use data disks or convert to GPT for more. The OS disk has a maximum capacity of 4,095 GiB, but many operating systems use MBR partitioning by default, and an MBR limits the usable size to 2 TiB.
Why A is wrong: The MBR usable limit is 2 TiB, not 4 TiB, and the OS disk maximum is 4,095 GiB, so both values are wrong.
Why B is correct: Correct. The OS disk has a maximum capacity of 4,095 GiB, but many operating systems use MBR partitioning by default, and an MBR limits the usable size to 2 TiB.
Why C is wrong: The documented MBR usable limit is 2 TiB rather than 1 TiB, so the partition reason is misstated.
Why D is wrong: The OS disk maximum capacity is 4,095 GiB; 32,767 GiB is not the documented OS disk maximum.
lock_openFree sampleManage Azure Identities and Governancehard
A resource has both a role assignment granting a user access and a deny assignment that applies to the same user and action. When Azure Resource Manager evaluates the request, the role assignment is checked first and grants access, so the deny assignment is ignored. Is this statement correct?
- AYes
- BNocheck_circle Correct
Deny assignments are evaluated first and override role assignments. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments. Deny assignments take precedence, so the request is blocked, not allowed.
Why A is wrong: Answering Yes assumes role assignments are checked first and win, but the grounding gives deny assignments precedence and evaluates them before role assignments.
Why B is correct: Correct. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments.
lock_openFree sampleManage Azure Identities and Governancemedium
An administrator wants to manually add a specific user to a group that uses dynamic membership. Statement: An administrator can manually add or remove a member of a dynamic membership group. Is this statement correct?
- AYes
- BNocheck_circle Correct
Dynamic group membership is rule-driven only, so members cannot be added or removed by hand. No is correct because membership of a dynamic membership group is computed automatically: the system evaluates the rule when attributes change and adds users who satisfy it or removes those who no longer do. The documentation states you can't manually add or remove a member of such a group, so a manual add is not possible.
Why A is wrong: The documentation states you can't manually add or remove a member of a dynamic membership group; membership is determined solely by whether the user satisfies the rule. To include the extra person, the rule must change or the user's attributes must match it.
Why B is correct: Correct. No is correct because membership of a dynamic membership group is computed automatically: the system evaluates the rule when attributes change and adds users who satisfy it or removes those who no longer do.
lock_openFree sampleManage Azure Identities and Governancemedium
An administrator is designing a single dynamic membership group. Statement: A security group can use a single dynamic rule that includes both users and devices as members. Is this statement correct?
- AYes
- BNocheck_circle Correct
A single dynamic rule targets users or devices, never both, so combined user-and-device membership needs two separate groups. No is correct because the documentation limits a dynamic membership rule to a single object type: you can create dynamic membership groups for users or for devices, but you can't create a rule that contains both users and devices. A security group can include either devices or users, not both in one dynamic rule.
Why A is wrong: You can create dynamic membership groups for users or devices, but you can't create a rule that contains both users and devices. Security groups can include either devices or users, so the combined-rule design is not allowed and the work must be split across two groups.
Why B is correct: Correct. No is correct because the documentation limits a dynamic membership rule to a single object type: you can create dynamic membership groups for users or for devices, but you can't create a rule that contains both users and devices.
lock_openFree sampleImplement and Manage Storagehard
An architect compares geo-redundant storage and geo-zone-redundant storage for a critical account. Both replicate to a paired secondary region. What is the primary difference between GRS and GZRS?
- AHow data is replicated within the account primary regioncheck_circle Correct
- BWhether the secondary region copy is encrypted at all
- CWhether any secondary region copy is created at all
- DHow the secondary region replicates the copied account
GRS and GZRS differ only in primary-region replication (LRS versus ZRS); the secondary always uses LRS. The docs state the primary difference between GRS and GZRS is how data is replicated in the primary region: GRS uses LRS and GZRS uses ZRS, while within the secondary region data is always replicated synchronously using LRS for both.
Why A is correct: Correct. The docs state the primary difference between GRS and GZRS is how data is replicated in the primary region: GRS uses LRS and GZRS uses ZRS, while within the secondary region data is always replicated synchronously using LRS for both.
Why B is wrong: All redundancy options encrypt data in both regions, so encryption is not the difference.
Why C is wrong: Both GRS and GZRS create a secondary region copy, so this is not the difference.
Why D is wrong: Within the secondary region both options always replicate synchronously using LRS.
lock_openFree sampleImplement and Manage Storagemedium
A finance team runs an analytics pipeline that must keep all data inside one Azure region for governance reasons, yet still survive the loss of an entire datacenter in that region. Which redundancy option meets both requirements at the lowest replication scope?
- ALocally redundant storage, copying data within one datacenter
- BZone-redundant storage, copying data across three or more zonescheck_circle Correct
- CGeo-redundant storage, copying data to a distant second region
- DRead-access geo-redundant storage, exposing the second region
ZRS gives intra-region datacenter resilience without crossing a regional boundary, unlike any geo-redundant option. Zone-redundant storage copies data synchronously across three or more availability zones inside the chosen primary region, so data remains durable and available if one datacenter or zone is lost while never leaving the region.
Why A is wrong: LRS keeps copies in a single physical datacenter, so a datacenter loss can make all replicas unavailable.
Why B is correct: Correct. Zone-redundant storage copies data synchronously across three or more availability zones inside the chosen primary region, so data remains durable and available if one datacenter or zone is lost while never leaving the region.
Why C is wrong: GRS replicates to a second geographic region, which violates the in-region governance requirement.
Why D is wrong: RA-GRS also copies to a second region and adds secondary read access, breaching the in-region rule.
lock_openFree sampleImplement and Manage Storagehard
After a sudden total loss of the primary region, an operator running a GRS account fails over to the secondary and finds the latest writes are missing. Which characteristic of geo-redundant storage explains this gap?
- AReplication to the secondary region happens asynchronouslycheck_circle Correct
- BReplication to the secondary region happens synchronously
- CThe secondary region drops writes during any failover
- DThe secondary region encrypts writes with a slower key
Geo-replication to the secondary is asynchronous, so a hard primary loss can lose the most recent writes. Because data is replicated to the secondary region asynchronously, a failure affecting the primary may result in data loss if the primary cannot be recovered; the lag between primary and secondary writes is the recovery point objective.
Why A is correct: Correct. Because data is replicated to the secondary region asynchronously, a failure affecting the primary may result in data loss if the primary cannot be recovered; the lag between primary and secondary writes is the recovery point objective.
Why B is wrong: Geo-replication to the secondary is asynchronous, not synchronous, which is what causes the gap.
Why C is wrong: Failover does not delete writes; the lag exists because replication is asynchronous before the outage.
Why D is wrong: Encryption speed has nothing to do with the replication lag; data in both regions is encrypted.
lock_openFree sampleConfigure and Manage Virtual Networkinghard
An administrator globally peers two virtual networks in different regions and then expects a resource in one network to reach the front-end IP address of a basic load balancer that sits in the other, globally peered network. Will that resource be able to reach the basic load balancer front-end IP?
- AYes
- BNocheck_circle Correct
Across a global peering, basic load balancer front-end IPs are not reachable from the other virtual network. No is correct because the grounding lists, among constraints that apply only when virtual networks are globally peered, that resources in one virtual network can't communicate with the front-end IP address of a basic load balancer, internal or public, in a globally peered virtual network.
Why A is wrong: Answering Yes would overlook the documented global peering constraint, since resources in one network cannot reach the front-end IP of a basic load balancer in a globally peered network.
Why B is correct: Correct. No is correct because the grounding lists, among constraints that apply only when virtual networks are globally peered, that resources in one virtual network can't communicate with the front-end IP address of a basic load balancer, internal or public, in a globally peered virtual network.
lock_openFree sampleConfigure and Manage Virtual Networkingmedium
An administrator must connect two virtual networks that sit in two different Azure regions so resources in each can reach the other directly. Which connectivity option meets this requirement?
- AConfigure global virtual network peering between the two virtual networkscheck_circle Correct
- BConfigure regional virtual network peering between the two virtual networks
- CConfigure a service endpoint on a subnet in each virtual network
- DConfigure a point-to-site VPN between the two virtual networks
Global virtual network peering is the option for connecting virtual networks that are in different Azure regions. The grounding states Azure supports global virtual network peering to connect virtual networks across Azure regions, whereas regular virtual network peering connects virtual networks within the same region.
Why A is correct: Correct. The grounding states Azure supports global virtual network peering to connect virtual networks across Azure regions, whereas regular virtual network peering connects virtual networks within the same region.
Why B is wrong: Regional virtual network peering connects virtual networks within the same Azure region, so it cannot join networks in different regions.
Why C is wrong: A service endpoint extends a subnet to an Azure service resource and does not interconnect two virtual networks for direct resource-to-resource traffic.
Why D is wrong: Point-to-site VPN is established between a virtual network and a single computer, not between two virtual networks for general connectivity.
lock_openFree sampleConfigure and Manage Virtual Networkingmedium
An administrator adds a custom inbound rule at priority 200 that allows TCP 443 from the internet, and a second custom inbound rule at priority 150 that denies the same traffic. A web request arrives that matches both rules. Which rule determines the outcome and why?
- AThe priority 200 allow rule wins because higher priority numbers are processed first
- BThe priority 150 deny rule wins because a lower priority number is processed firstcheck_circle Correct
- CBoth rules apply in turn because evaluation continues after the first match is found
- DNeither rule wins because two rules cannot share one direction inside the group
Lower priority numbers are evaluated first and the first matching rule ends evaluation, so a lower-numbered deny overrides a higher-numbered allow. Rules are processed in priority order, with lower numbers processed before higher numbers because lower numbers have higher priority, and once traffic matches a rule the processing stops. The priority 150 deny is processed before the priority 200 allow.
Why A is wrong: Higher numbers have lower priority, so the priority 200 rule is processed after the priority 150 rule, not before it.
Why B is correct: Correct. Rules are processed in priority order, with lower numbers processed before higher numbers because lower numbers have higher priority, and once traffic matches a rule the processing stops.
Why C is wrong: Once traffic matches a rule, processing stops, so the second rule is never reached for that flow.
Why D is wrong: Multiple inbound rules are allowed; only identical priority within the same direction is disallowed, which is not the case here.
lock_openFree sampleMonitor and Maintain Azure Resourcesmedium
An administrator reviews which data sources a diagnostic setting can collect and route to destinations. Which sources are valid diagnostic setting sources? (Select 3 answers)
- APlatform metrics produced automatically by the monitored resourcecheck_circle Correct
- BResource logs that are not gathered until a setting enables themcheck_circle Correct
- CActivity log entries describing operations on the subscriptioncheck_circle Correct
- DPrometheus metrics scraped from a managed Kubernetes cluster
- ECustom metrics pushed straight from an instrumented application
The diagnostic setting sources are platform metrics, the activity log, and resource logs; Prometheus and custom metrics use other pipelines. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why A is correct: Correct. Platform metrics produced automatically by the monitored resource is one of the keyed answers. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why B is correct: Correct. Resource logs that are not gathered until a setting enables them is one of the keyed answers. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why C is correct: Correct. Activity log entries describing operations on the subscription is one of the keyed answers. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why D is wrong: Prometheus metrics flow to an Azure Monitor workspace through managed Prometheus, not through a diagnostic setting source.
Why E is wrong: Custom metrics enter via the custom metrics API or Application Insights, not as a diagnostic setting source.
lock_openFree sampleMonitor and Maintain Azure Resourcesmedium
A developer who knows Kusto Query Language wants to write read-only queries against collected log and trace data, then reuse those queries in alerts and workbooks. Which Azure Monitor tool do they use?
- AMetrics Explorer in chart mode, which plots numeric time-series values over time
- BLog Analytics in KQL mode, which runs read-only queries over workspace tablescheck_circle Correct
- CActivity Log search, which lists control-plane operations on subscription resources
- DAutoscale rules editor, which scales resources based on metric or schedule rules
Log Analytics runs KQL queries over workspace log data; those saved queries feed alerts, workbooks, and dashboards. Log Analytics is the Azure portal tool for running KQL log queries against workspace tables; KQL mode lets a familiar user author queries and reuse them in alerts and workbooks.
Why A is wrong: Metrics Explorer charts numeric metrics; it does not run KQL over log tables.
Why B is correct: Correct. Log Analytics is the Azure portal tool for running KQL log queries against workspace tables; KQL mode lets a familiar user author queries and reuse them in alerts and workbooks.
Why C is wrong: Activity log search browses control-plane events, not arbitrary KQL queries over log tables.
Why D is wrong: Autoscale adds and removes resources on rules; it is not a log query tool.
lock_openFree sampleMonitor and Maintain Azure Resourceshard
An administrator plans diagnostic settings that route a regional resource's logs to a storage account and an event hub. Which constraints apply when configuring these destinations? (Select 2 answers)
- AThe destination resource must already exist before the setting is createdcheck_circle Correct
- BA regional destination must sit in the same region as the monitored resourcecheck_circle Correct
- CThe destination must live in the same subscription as the monitored resource
- DThe destination must use a premium storage account for resource log data
- EThe destination accepts at most three diagnostic settings for each resource
Destinations must pre-exist, and regional storage or event hub destinations must share the monitored resource's region. Two constraints apply to all destination types: the destination resource must already exist before the setting is created, and for regional resources the destination must be in the same region as the monitored resource.
Why A is correct: Correct. The destination resource must already exist before the setting is created is one of the keyed answers. Two constraints apply to all destination types: the destination resource must already exist before the setting is created, and for regional resources the destination must be in the same region as the monitored resource.
Why B is correct: Correct. A regional destination must sit in the same region as the monitored resource is one of the keyed answers. Two constraints apply to all destination types: the destination resource must already exist before the setting is created, and for regional resources the destination must be in the same region as the monitored resource.
Why C is wrong: Cross-subscription destinations are allowed when the configuring user has RBAC access to both subscriptions.
Why D is wrong: Premium storage accounts are not supported as destinations; standard storage accounts are required.
Why E is wrong: Each resource can have up to five diagnostic settings, not three.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. AZ-104 and related marks belong to their respective owners.
