15 real AZ-104 sample questions, each with a worked explanation and a rationale for every option, right and wrong. No account, no card. This is the reasoning the AZ-104 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real AZ-104 is Typically 40 to 60 questions questions in 120 minutes, pass mark 700 / 1000. For a domain-by-domain breakdown and a study plan, read the AZ-104 study guide. The full bank has 242 questions.
lock_openFree sampleDeploy and Manage Azure Compute Resourcesmedium
You deploy an ARM template that defines a storage account with a fixed name and Standard_LRS SKU. A storage account with exactly those properties already exists in the target resource group. What happens when the deployment runs?
- ANo changes are made to the existing storage account because templates are idempotent.check_circle Correct
- BThe deployment fails because a resource with that name already exists in the group.
- CA second storage account is created with a numeric suffix appended to the name.
- DThe existing account is deleted and then recreated from the template values.
Deploying a template whose desired state already exists results in no changes, because templates are idempotent. ARM templates are idempotent: you can deploy the same template many times and get the same resource types in the same state. The docs state that if the storage account with the specified properties already exists, no changes are made.
Why A is correct: Correct. ARM templates are idempotent: you can deploy the same template many times and get the same resource types in the same state.
Why B is wrong: Idempotency means redeploying the same desired state succeeds without error rather than failing on the existing resource.
Why C is wrong: Resource Manager matches on the declared name and type; it does not auto-generate a parallel resource with a suffix.
Why D is wrong: When the declared state already matches, Resource Manager makes no changes rather than tearing down and rebuilding the resource.
lock_openFree sampleDeploy and Manage Azure Compute Resourcesmedium
In an ARM template you need to return the name of a deployed storage account so a calling pipeline can consume it after deployment. Which top-level template section do you use?
- AOutputscheck_circle Correct
- BVariables
- CParameters
- DResources
Outputs return values from deployed resources; parameters take values in, variables are internal reuse. The docs define outputs as the section that returns values from the deployed resources. Returning the storage account name for a downstream consumer is exactly that purpose.
Why A is correct: Correct. The docs define outputs as the section that returns values from the deployed resources.
Why B is wrong: Variables define values you reuse inside the template; they are not returned to the caller after deployment.
Why C is wrong: Parameters provide values into the deployment at start; they do not return values from deployed resources.
Why D is wrong: The resources section specifies what to deploy; returning a value to the caller is the job of outputs.
lock_openFree sampleDeploy and Manage Azure Compute Resourcesmedium
You want the same ARM template to deploy to development and production with different values supplied at deploy time. Which template section is designed to accept these per-environment values during deployment?
- AParameterscheck_circle Correct
- BOutputs
- CVariables
- DFunctions
Parameters customize one template for different environments by supplying values during deployment. The docs describe parameters as values provided during deployment that you customize for different environments when using the same template. That matches the dev versus production requirement.
Why A is correct: Correct. The docs describe parameters as values provided during deployment that you customize for different environments when using the same template.
Why B is wrong: Outputs return values from deployed resources back to the caller; they do not accept input values at deploy time.
Why C is wrong: Variables hold values you reuse within the template and can be built from parameters, but they are not supplied at deployment.
Why D is wrong: User-defined functions create reusable expressions; they do not accept per-environment values from the deploying caller.
lock_openFree sampleManage Azure Identities and Governancehard
A resource has both a role assignment granting a user access and a deny assignment that applies to the same user and action. When Azure Resource Manager evaluates the request, the role assignment is checked first and grants access, so the deny assignment is ignored. Is this statement correct?
- AYes
- BNocheck_circle Correct
Deny assignments are evaluated first and override role assignments. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments. Deny assignments take precedence, so the request is blocked, not allowed.
Why A is wrong: Answering Yes assumes role assignments are checked first and win, but the grounding gives deny assignments precedence and evaluates them before role assignments.
Why B is correct: Correct. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments.
lock_openFree sampleManage Azure Identities and Governancemedium
An administrator needs to let a teammate fully manage all resources in the prod-rg resource group, including creating and deleting virtual machines, but the teammate must not be able to assign roles to other users at that scope. Which built-in role should the administrator assign at the resource group scope?
- AContributorcheck_circle Correct
- BOwner
- CReader
- DUser Access Administrator
Contributor manages all resources but cannot assign roles; Owner is Contributor plus role assignment. The grounding states Contributor grants full access to manage all resources but cannot assign roles in Azure RBAC, while Owner grants full management and can also assign roles. The requirement is full management without role-assignment, which is exactly Contributor.
Why A is correct: Correct. The grounding states Contributor grants full access to manage all resources but cannot assign roles in Azure RBAC, while Owner grants full management and can also assign roles.
Why B is wrong: Owner also grants full management of all resources, which is tempting, but Owner adds the ability to assign roles in Azure RBAC. That extra capability is exactly what the requirement forbids.
Why C is wrong: Reader is a low-privilege role that can view resources but cannot change them, so it cannot create or delete the virtual machines the teammate needs to manage.
Why D is wrong: User Access Administrator manages user access and can assign roles, including Owner, but it is centred on access management rather than full resource management, and it grants the role-assignment ability the requirement forbids.
lock_openFree sampleManage Azure Identities and Governancemedium
An administrator is preparing role assignments and needs to confirm which kinds of identities can be assigned an Azure role as the security principal. Which of the following are valid security principals for an Azure role assignment? (Select 3 answers)
- AA user with a profile in Microsoft Entra IDcheck_circle Correct
- BA service principal used by an applicationcheck_circle Correct
- CA managed identity automatically managed by Azurecheck_circle Correct
- DA resource group that contains the resources
- EA role definition listing the allowed actions
Security principals are users, groups, service principals, and managed identities; scopes and role definitions are not principals. The grounding defines a security principal as an object representing a user, group, service principal, or managed identity that is requesting access, and states you can assign a role to any of these. User, service principal, and managed identity are all on that list.
Why A is correct: Correct. A user with a profile in Microsoft Entra ID is one of the keyed answers. The grounding defines a security principal as an object representing a user, group, service principal, or managed identity that is requesting access, and states you can assign a role to any of these.
Why B is correct: Correct. A service principal used by an application is one of the keyed answers. The grounding defines a security principal as an object representing a user, group, service principal, or managed identity that is requesting access, and states you can assign a role to any of these.
Why C is correct: Correct. A managed identity automatically managed by Azure is one of the keyed answers. The grounding defines a security principal as an object representing a user, group, service principal, or managed identity that is requesting access, and states you can assign a role to any of these.
Why D is wrong: A resource group is a scope at which roles are assigned, not an identity that requests access, so it cannot be the security principal in an assignment.
Why E is wrong: A role definition is the collection of permissions being granted, one of the three elements of an assignment, but it is not the identity receiving the access.
lock_openFree sampleImplement and Manage Storagehard
An architect compares geo-redundant storage and geo-zone-redundant storage for a critical account. Both replicate to a paired secondary region. What is the primary difference between GRS and GZRS?
- AHow data is replicated within the account primary regioncheck_circle Correct
- BWhether the secondary region copy is encrypted at all
- CWhether any secondary region copy is created at all
- DHow the secondary region replicates the copied account
GRS and GZRS differ only in primary-region replication (LRS versus ZRS); the secondary always uses LRS. The docs state the primary difference between GRS and GZRS is how data is replicated in the primary region: GRS uses LRS and GZRS uses ZRS, while within the secondary region data is always replicated synchronously using LRS for both.
Why A is correct: Correct. The docs state the primary difference between GRS and GZRS is how data is replicated in the primary region: GRS uses LRS and GZRS uses ZRS, while within the secondary region data is always replicated synchronously using LRS for both.
Why B is wrong: All redundancy options encrypt data in both regions, so encryption is not the difference.
Why C is wrong: Both GRS and GZRS create a secondary region copy, so this is not the difference.
Why D is wrong: Within the secondary region both options always replicate synchronously using LRS.
lock_openFree sampleImplement and Manage Storagehard
After a sudden total loss of the primary region, an operator running a GRS account fails over to the secondary and finds the latest writes are missing. Which characteristic of geo-redundant storage explains this gap?
- AReplication to the secondary region happens asynchronouslycheck_circle Correct
- BReplication to the secondary region happens synchronously
- CThe secondary region drops writes during any failover
- DThe secondary region encrypts writes with a slower key
Geo-replication to the secondary is asynchronous, so a hard primary loss can lose the most recent writes. Because data is replicated to the secondary region asynchronously, a failure affecting the primary may result in data loss if the primary cannot be recovered; the lag between primary and secondary writes is the recovery point objective.
Why A is correct: Correct. Because data is replicated to the secondary region asynchronously, a failure affecting the primary may result in data loss if the primary cannot be recovered; the lag between primary and secondary writes is the recovery point objective.
Why B is wrong: Geo-replication to the secondary is asynchronous, not synchronous, which is what causes the gap.
Why C is wrong: Failover does not delete writes; the lag exists because replication is asynchronous before the outage.
Why D is wrong: Encryption speed has nothing to do with the replication lag; data in both regions is encrypted.
lock_openFree sampleImplement and Manage Storagemedium
A web app must give external clients short-lived read access to blobs without storing the storage account key in application code. Microsoft recommends the most secure SAS type for this. Which SAS type should the app generate?
- AA user delegation SAS signed by an Entra keycheck_circle Correct
- BA service SAS signed with the storage account key
- CAn account SAS signed with the storage account key
- DA service SAS bound to a stored access policy
User delegation SAS is signed with a user delegation key from Entra ID and is the recommended, most secure SAS type. A user delegation SAS is secured with Microsoft Entra credentials instead of the account key, which the documentation says provides superior security and is the recommended SAS type.
Why A is correct: Correct. A user delegation SAS is secured with Microsoft Entra credentials instead of the account key, which the documentation says provides superior security and is the recommended SAS type.
Why B is wrong: A service SAS is secured with the account key, so the app would need access to that key.
Why C is wrong: An account SAS is also secured with the account key rather than Microsoft Entra credentials.
Why D is wrong: Binding to a policy still leaves the SAS signed by the account key, not Entra credentials.
lock_openFree sampleConfigure and Manage Virtual Networkingmedium
An administrator must connect two virtual networks that sit in two different Azure regions so resources in each can reach the other directly. Which connectivity option meets this requirement?
- AConfigure global virtual network peering between the two virtual networkscheck_circle Correct
- BConfigure regional virtual network peering between the two virtual networks
- CConfigure a service endpoint on a subnet in each virtual network
- DConfigure a point-to-site VPN between the two virtual networks
Global virtual network peering is the option for connecting virtual networks that are in different Azure regions. The grounding states Azure supports global virtual network peering to connect virtual networks across Azure regions, whereas regular virtual network peering connects virtual networks within the same region.
Why A is correct: Correct. The grounding states Azure supports global virtual network peering to connect virtual networks across Azure regions, whereas regular virtual network peering connects virtual networks within the same region.
Why B is wrong: Regional virtual network peering connects virtual networks within the same Azure region, so it cannot join networks in different regions.
Why C is wrong: A service endpoint extends a subnet to an Azure service resource and does not interconnect two virtual networks for direct resource-to-resource traffic.
Why D is wrong: Point-to-site VPN is established between a virtual network and a single computer, not between two virtual networks for general connectivity.
lock_openFree sampleConfigure and Manage Virtual Networkingmedium
An administrator creates a new Standard SKU public IP address and wants to confirm which allocation method it will use. Which allocation method does a Standard SKU public IP address use?
- AStatic allocation, which is the only method for the Standard SKUcheck_circle Correct
- BDynamic allocation, which assigns the address when it is later associated
- CEither static or dynamic, selectable at creation for Standard SKU
- DDynamic for IPv4 and static for IPv6 under the Standard SKU
A Standard SKU public IP address always uses static allocation. The grounding SKU table lists the Standard allocation method as Static, and the assignment table marks both Standard public IPv4 and Standard public IPv6 as static only.
Why A is correct: Correct. The grounding SKU table lists the Standard allocation method as Static, and the assignment table marks both Standard public IPv4 and Standard public IPv6 as static only.
Why B is wrong: Dynamic allocation is available for Basic SKU IPv4 addresses, but Standard SKU public IP addresses use static allocation only.
Why C is wrong: The choice between static and dynamic applies to Basic SKU IPv4 addresses; the Standard SKU allocation method is fixed as static.
Why D is wrong: Both Standard public IPv4 and Standard public IPv6 are static; the dynamic-for-IPv6 behaviour belongs to the Basic SKU.
lock_openFree sampleConfigure and Manage Virtual Networkingmedium
A subnet route table contains one route for the 10.0.0.0/16 prefix and another route for the 10.0.0.0/24 prefix. To which route does Azure send traffic destined for 10.0.0.5?
- AThe route for 10.0.0.0/24, because it is the longest matching prefixcheck_circle Correct
- BThe route for 10.0.0.0/16, because it covers the wider address range here
- CBoth routes equally, because the address falls within each prefix
- DThe system route for 0.0.0.0/0, because it acts as the default
Azure routes a destination to the route with the longest matching address prefix. The grounding states Azure selects a route using the longest prefix match algorithm, so 10.0.0.5 follows the 10.0.0.0/24 route because that prefix is longer than 10.0.0.0/16 even though the address falls within both.
Why A is correct: Correct. The grounding states Azure selects a route using the longest prefix match algorithm, so 10.0.0.5 follows the 10.0.0.0/24 route because that prefix is longer than 10.0.0.0/16 even though the address falls within both.
Why B is wrong: A wider range is the shorter prefix; Azure uses longest prefix match, so the broader 10.0.0.0/16 route is not selected for 10.0.0.5.
Why C is wrong: The address does fall within both prefixes, yet Azure picks only one route, selecting the longer prefix rather than both.
Why D is wrong: The 0.0.0.0/0 route is the shortest prefix and is used only when no longer matching route exists for the destination.
lock_openFree sampleMonitor and Maintain Azure Resourcesmedium
An administrator needs to store numeric values that describe resource performance at regular intervals and analyze them in near real time with a time-series store. Which half of the Azure Monitor data platform fits this need?
- AAzure Monitor Metrics, which keeps numeric data in a time-series databasecheck_circle Correct
- BAzure Monitor Logs, which keeps event records that you query with KQL
- CAzure Activity Log, which keeps the audit trail of control-plane writes
- DAzure Service Health, which keeps the status of platform-wide incidents
Metrics is the numeric, time-series half of the Azure Monitor data platform; Logs is the queryable record half. Azure Monitor Metrics is the half of the data platform that collects numeric values at regular intervals into a time-series database optimized for near real-time analysis.
Why A is correct: Correct. Azure Monitor Metrics is the half of the data platform that collects numeric values at regular intervals into a time-series database optimized for near real-time analysis.
Why B is wrong: Logs holds log and trace records queried with KQL, not the time-series numeric store described.
Why C is wrong: The activity log records control-plane operations, not regular-interval numeric performance values.
Why D is wrong: Service Health reports platform incidents and advisories, not a time-series store of resource metrics.
lock_openFree sampleMonitor and Maintain Azure Resourcesmedium
A team deploys several Azure resources and wants basic health and performance metrics for each one. They are unsure what setup is required to start collecting platform metrics. What should you tell them?
- APlatform metrics are produced by each resource with no configuration and no extra costcheck_circle Correct
- BPlatform metrics require a diagnostic setting on each resource before any values appear
- CPlatform metrics require the Azure Monitor Agent installed on each resource first
- DPlatform metrics require a Log Analytics workspace linked to each resource first
Platform metrics are free and automatic; you only configure things when you want to route them somewhere else. Platform metrics are created by Azure resources automatically, requiring no configuration and carrying no cost, with each resource type producing a distinct set of metrics.
Why A is correct: Correct. Platform metrics are created by Azure resources automatically, requiring no configuration and carrying no cost, with each resource type producing a distinct set of metrics.
Why B is wrong: Diagnostic settings only route platform metrics elsewhere; the metrics are already collected without one.
Why C is wrong: The agent gathers guest OS metrics, but platform metrics from Azure resources need no agent.
Why D is wrong: A workspace is a logs destination; platform metrics are produced and stored without one.
lock_openFree sampleMonitor and Maintain Azure Resourcesmedium
An administrator opens Metrics Explorer and sets the time picker to span 45 days for a single platform metric chart, but the chart shows no data. Platform metrics are retained for 93 days. What is the most likely cause?
- AA single chart can query at most a 30-day interval, so the wider span returns nothingcheck_circle Correct
- BA single chart can query at most a 14-day interval, so the wider span returns nothing
- CPlatform metrics are purged after 31 days, so data beyond that window is gone
- DPlatform metrics need a diagnostic setting to a workspace before any chart renders
Platform metric retention is 93 days, but the per-chart query window caps at 30 days; pan to see more. Although platform metrics are stored for 93 days, any single chart can only query a maximum of 30 days of data; a 45-day span exceeds that and returns nothing until you narrow the interval.
Why A is correct: Correct. Although platform metrics are stored for 93 days, any single chart can only query a maximum of 30 days of data; a 45-day span exceeds that and returns nothing until you narrow the interval.
Why B is wrong: Fourteen days is the floor for classic guest OS metrics in storage, not the chart query limit.
Why C is wrong: Platform metrics are retained 93 days; 31 days applies to Log Analytics agent guest OS metrics.
Why D is wrong: Platform metrics chart in Metrics Explorer with no diagnostic setting at all.
Examworthy is not affiliated with or endorsed by Microsoft. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. AZ-104 and related marks belong to their respective owners.
