Free Preparation Discussions
MENU
Microsoft AZ-104 Exam Questions
There's no shortage of AZ-104 exam questions online, but what matters is whether they still match Microsoft's latest topic update for the Azure Administrator exam. The AZ-104 exam questions below come straight from the practice bank our candidates use before test day. These aren't recycled dumps: every question tracks Microsoft's current revision of the exam. If your exam is close, start practicing right away and use the domain weightings further down to see where you stand. If you're still early in your preparation, the topic map and Microsoft's revision history will show you exactly what you're walking into.
| Exam name | Microsoft Azure Administrator Exam |
| Exam code | AZ-104 |
| Certification | Azure Administrator Associate |
| Practice questions in our bank | 479 |
| Questions on the real exam | 40 |
| Time allowed | 100 minutes |
| Passing score | 700 / 1000 |
| Exam cost | USD 165 (varies by country) |
| Retake policy | 24h after 1st fail, 14 days thereafter, max 5/year |
| Certification validity | 1 year, free online renewal |
AZ-104 Exam Practice Questions
The questions below are free samples from the same 477-question AZ-104 bank our candidates prepare with, in the order Microsoft weights the domains.
You have an Azure subscription that contains an Azure Stream Analytics job named Job1.
You need to monitor input events for Job1 to identify the number of events that were NOT processed.
Which metric should you use?
Correct Answer: B
Backlogged Input Events is a metric that shows the number of input events that are waiting to be processed by the Stream Analytics job1. This metric indicates the performance and health of the job, as well as the input data rate and latency.If the Backlogged Input Events metric is high or increasing, it means that the job is not able to keep up with the incoming events and some events are not processed in a timely manner2.
Output Events is a metric that shows the number of output events that are emitted by the Stream Analytics job1. This metric indicates the output data rate and throughput of the job. It does not show how many input events were not processed by the job.
Out-of-Order Events is a metric that shows the number of input events that arrive out of order based on their timestamp1. This metric indicates the quality and consistency of the input data source. It does not show how many input events were not processed by the job.
Late Input Events is a metric that shows the number of input events that arrive after the late arrival window has expired1. This metric indicates the timeliness and reliability of the input data source. It does not show how many input events were not processed by the job.
You have an Azure subscription that contains two virtual machines named VM1 and VM2
You create an Azure load balancer.
You plan to create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2.
Which two additional load balance resources should you create before you can create the load balancing rule? Each correct answer presents part of the solution
MOTL Each correct selection 5 worth one point.
Correct Answer: A, C
To create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2, you need to create two additional load balance resources: a frontend IP address and a health probe.
A frontend IP address is the IP address that the clients use to access the load balancer. It can be either public or private, depending on the type of load balancer.A frontend IP address is required for any load balancing rule1.
A health probe is used to monitor the health and availability of the backend instances. It can be either TCP, HTTP, or HTTPS, depending on the protocol of the load balancing rule.A health probe is required for any load balancing rule1.
A backend pool is a group of backend instances that receive the traffic from the load balancer. You already have a backend pool that contains VM1 and VM2, so you don't need to create another one.
An inbound NAT rule is used to forward traffic from a specific port on the frontend IP address to a specific port on a backend instance.It's not required for a load balancing rule, but it can be used to access individual instances for troubleshooting or maintenance purposes1.
A virtual network is a logical isolation of Azure resources within a region.It's not a load balance resource, but it's required for creating an internal load balancer or connecting virtual machines to a load balancer2.
You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial
reporting app named App1 that does not support multiple active instances.
At the end of each month, CPU usage for VM1 peaks when App1 runs.
You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month.
What task should you include in the runbook?
Correct Answer: E
To create a scheduled runbook to increase the processor performance of VM1 at the end of each month, you need to modify the VM size property of VM1. This will allow you to scale up the VM to a larger size that has more CPU cores and memory. You can use Azure Automation to create a PowerShell runbook that changes the VM size using the Set-AzVM cmdlet. You can then schedule the runbook to run at the end of each month using the Azure portal or Azure PowerShell.For more information, seeHow to resize a virtual machine in Azure using Azure Automation1.
You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements.
Which storage account should you identify?
Correct Answer: C
You must identify the correct storage account for flow logging of IP traffic from VM5 that satisfies the retention requirement of eight months.
Step 1 --- Review the Requirements
Flow logs are stored in a StorageV2 (general purpose v2) account.
The selected storage account must support Network Watcher flow logs.
Data must be retained for eight months ( 240 days).
Step 2 --- Evaluate Each Storage Account
Storage Account
Kind
Region
Remarks
storage1
Storage (general purpose v1)
West US
Does not support flow logs (deprecated type).
storage2
StorageV2 (general purpose v2)
East US
Fully supports flow logs and lifecycle management.
storage3
BlobStorage
East US 2
Not suitable --- supports blobs only, not log structure or lifecycle retention.
storage4
FileStorage
Central US
File-only --- cannot store flow logs.
Step 3 --- Compliance with Flow Log Retention
Flow logs for Network Watcher NSG flow logging are supported only by StorageV2 accounts. You can use Azure Storage lifecycle management to automatically delete logs after a set period --- such as 240 days (8 months) --- to comply with retention requirements.
Official Microsoft Note: ''Network security group (NSG) flow logs are stored in Azure StorageV2 (General Purpose v2) accounts, which support lifecycle management for log retention.'' --- Azure Network Watcher documentation.
Conclusion
storage2 is the only StorageV2 account.
It's located in East US, matching VM5's region (East US) --- this satisfies performance and compliance requirements.
You have an Azure Subscription that contains the virtual networks Shown in the following table.
All the virtual networks are peered. Each virtual network contains nine virtual machines.
You need to configure secure RDP corrections to the virtual machines by using Azure Boston.
Whit is the minimum number of Bastion nests required?
Correct Answer: B
According to theMicrosoft documentation, Azure Bastion is a service that provides more secure and seamless RDP and SSH access to virtual machines without any exposure through public IP addresses. You can provision the service directly in your local or peered virtual network to get support for all the VMs within it.
In your scenario, you have three virtual networks that are peered with each other. This means that they can communicate with each other as if they were in the same virtual network. Therefore, you can deploy one Bastion host in any of the virtual networks and use it to connect to all the virtual machines in the peered virtual networks. You don't need to deploy a separate Bastion host for each virtual network or each virtual machine.
For more information about how to deploy and use Azure Bastion, seeTutorial: Deploy Bastion using specified settings: Azure portal.
AZ-104 Exam Topics & Weightings: Microsoft's Current Outline
Topics and weightings follow Microsoft's official skills outline.
Manage Azure identities and governance
20–25%Covers Microsoft Entra users and groups (including licenses, external users, and self-service password reset), Azure role assignments and their scopes, and governance tools: Azure Policy, resource locks, tags, budgets, and management groups. Expect questions that state a least-privilege or compliance requirement and ask which role, scope, or policy satisfies it, plus items where you interpret an existing set of access assignments.
Implement and manage storage
15–20%Covers storage accounts and their redundancy, encryption, and network access settings, access control through SAS tokens, stored access policies, access keys, and identity-based access, plus Azure Files and Blob Storage configuration: tiers, lifecycle management, soft delete, versioning, and snapshots. Questions here tend to be trade-off scenarios: which redundancy option, access method, or tier fits a stated cost, durability, or security constraint.
Deploy and manage Azure compute resources
20–25%Covers ARM templates and Bicep files (reading, modifying, and deploying them), virtual machines including sizes, disks, encryption at host, availability sets and zones, and scale sets, containers via Azure Container Registry, Container Instances, and Container Apps, and App Service plans with scaling, TLS, custom domains, and deployment slots. Template-reading questions are common: you're shown a snippet and asked what it deploys or how to change it.
Implement and manage virtual networking
15–20%Covers virtual networks, subnets, and peering, public IPs and user-defined routes, NSGs and application security groups, Azure Bastion, service endpoints and private endpoints, Azure DNS, and internal and public load balancers. This is the most diagnosis-heavy domain: expect to evaluate effective NSG rules, work out why two resources can't connect, and choose between endpoint types for securing PaaS access.
Monitor and maintain Azure resources
10–15%Covers Azure Monitor metrics, logs, and alert rules with action groups, insights for VMs, storage, and networks, Network Watcher and Connection Monitor, and the backup side: Recovery Services vaults, Backup vaults, backup policies, restore operations, and Site Recovery failover. The smallest domain by weight, but its questions are concrete: interpret a metric chart or log query result, or pick the right vault and policy for a recovery requirement.
Official Revisions by Microsoft
April 17, 2026 — : Minor objective updates across four of the five domains: Azure Files & Blob Storage configuration, virtual machine and container provisioning, virtual network configuration, and resource monitoring. Domain weightings unchanged. The audience profile was also revised.
April 18, 2025 — : Minor update; objective-level additions including soft delete for containers under storage.
October 2023 — : Update reflecting the Azure AD to Microsoft Entra ID renaming across identity objectives.
Source: Microsoft's official AZ-104 study guide change log (shows the latest revision; earlier entries reconstructed from archived copies). Our question bank is updated to match each revision.
What the AZ-104 Exam Really Tests, and How
The topic list above tells you what's on the exam. How you'll be tested is written into the wording of Microsoft's outline itself: objectives that say create and configure show up as different question types than ones that say interpret or troubleshoot. Read it this way and the outline becomes a format map.
Hands-on configuration skills
Tested via: hot area, drag-and-drop & command-completion questionsEvery "create and configure" objective (virtual machines, storage accounts, virtual networks, NSGs, App Service) can appear as a portal screenshot where you click the right setting, a drag-and-drop sequence of deployment steps, or a PowerShell/Azure CLI command with dropdowns for the missing parameters. Microsoft's audience profile explicitly expects experience with the portal, PowerShell, Azure CLI, and ARM/Bicep, so command syntax is fair game. You can try these question mechanics in Microsoft's official exam sandbox before test day.
Choosing the right solution under constraints
Tested via: scenario-based multiple-choice questionsShort scenarios give you a requirement (minimum cost, a specific SLA, data residency) and ask which redundancy option, storage tier, VM availability configuration, or load balancer meets it. These reward knowing the decision boundaries between similar services (LRS vs. ZRS vs. GRS, availability sets vs. zones), not the definitions. Note Microsoft's own guidance: questions mostly cover GA features, with preview features only if commonly used.
Multi-step reasoning across services
Tested via: case-study question setsA case study presents one company (existing environment, technical requirements, planned changes), followed by a block of questions that span identity, networking, storage, and compute at once. You can't return to earlier sections after leaving a case study, so budget your time accordingly. Recent candidates consistently report that scenario-driven, multi-step questions make up a growing share of the exam.
Troubleshooting & interpreting configurations
Tested via: exhibit-based questionsMicrosoft's outline repeatedly asks you to interpret, evaluate, and troubleshoot: interpret an ARM template or Bicep file, interpret access assignments, evaluate effective NSG security rules, troubleshoot network connectivity and load balancing. On the exam these become exhibits (a template snippet, a role-assignment table, an effective-routes screenshot) where you diagnose what will deploy, who has access, or why a connection fails.
How to Pass the AZ-104 Exam on Your First Attempt
Most candidates don't have months, and AZ-104 doesn't require months. What it punishes is unfocused preparation: reading everything once instead of practicing the areas that actually cost marks. The sequence below is the shortest route we know that holds up on test day.
Take a full question set cold, before any study. Your first score doesn't matter; the domain breakdown does. Twenty minutes of practice tells you more about where you stand than a week of reading.
For every question you miss, find out why the right answer wins. Check the option you picked against Microsoft Learn documentation. This feels slower than moving on to the next question. It isn't: AZ-104 reuses the same decision points (redundancy options, RBAC scopes, NSG rule order) across many questions, so one understood mistake fixes several future ones.
Spend your remaining time by weight, not by comfort. Identities and compute each carry 20–25% of the exam; monitoring carries 10–15%. A weak domain at the top of that list costs roughly twice what one at the bottom does. The topic map above shows where your gaps are most expensive.
Run one timed, full-length simulation before test day. One is enough. You're not testing knowledge anymore, you're testing pacing: case studies eat time, and you can't return to them once you move on. Whatever the simulation exposes, that's your final review list.
What to Look for in AZ-104 Practice Questions
and Why Prefer Pass4Success Practice Material
A failed AZ-104 attempt costs USD 165 plus a waiting period before you can rebook. Measured against that, the price of practice material matters far less than whether it prepares you for the exam Microsoft is running now. Here is what separates material worth your time from material that isn't.
Current with the latest exam revision
Microsoft revised the AZ-104 outline on April 17, 2026, and revises it periodically. Questions written for an older outline still look plausible; that's what makes them dangerous.
✓ Ours: the bank is updated on a regular cycle to reflect how Microsoft actually tests, not only when the syllabus changes. When Microsoft does revise the outline, affected questions are re-checked as well. The last update date is shown at the top of this page, so you never have to take freshness on faith.
A way to try before you pay
The exam prep market has earned its reputation for low-quality dumps. Any provider confident in its questions can show you some before asking for money.
✓ Ours: free demo of both formats, the PDF and the practice test, before any purchase. The free questions on this page are from the same bank.
Timed, exam-style practice, not just a question list
Reading questions and answering them under time pressure are different skills. Case studies in particular punish candidates who never practiced pacing.
✓ Ours: the practice test runs timed sessions; the PDF covers offline review. Both come together in one purchase, not as separate products.
Enough volume to expose your weak areas
Twenty sample questions can't cover five domains. You need enough questions per domain for a miss pattern to become visible.
✓ Ours: 477 AZ-104 questions across the exam's domains.
A cost that makes sense against the retake fee
The real comparison isn't between providers. It's between the cost of preparing properly once and the cost of booking the exam twice.
✓ Ours: Practice material is USD 69 less than the USD 165 Microsoft charges just to sit the exam once, and far cheaper than paying that fee twice after a failed attempt.
AZ-104 Exam Discussion: What Recent Candidates Say
The comments below are from candidates who recently sat AZ-104: what surprised them, which domains cost them marks, and what they'd study differently. If you've taken the exam, add what you learned; the next reader is preparing right now.
Ready to Pass AZ-104 on Your First Attempt?
Full access to all 477 AZ-104 questions, in both the PDF and the practice test.
Get Premium AccessFrequently Asked Questions
What skills are measured on the AZ-104 exam?
AZ-104 tests five domains: managing Azure identities and governance (20–25%), storage (15–20%), compute resources (20–25%), virtual networking (15–20%), and monitoring and maintenance (10–15%). The weightings come from Microsoft's outline effective April 17, 2026. The topic map above breaks down what each domain covers.
What are the prerequisites for taking the AZ-104 exam?
None. You can book AZ-104 directly, without AZ-900 or any other certification. Microsoft's audience profile does assume hands-on experience with the Azure portal, PowerShell, Azure CLI, and ARM templates or Bicep, and candidates who pass comfortably tend to have around six months of real Azure work behind them.
How hard is the AZ-104 exam?
Harder than most candidates expect if their preparation was reading-based. The questions test applied configuration decisions rather than definitions, and case studies mix identity, networking, and storage in one scenario. With regular hands-on Azure work it's demanding but manageable; without portal experience, the scenario questions turn into guesswork.
What types of questions are on the AZ-104 exam?
Multiple choice and multi-select, drag-and-drop, hot area questions where you click the right part of a screenshot, command completion for PowerShell and Azure CLI, and case studies: several questions built on one company scenario. Microsoft's free exam sandbox lets you try every format before test day.
What are the most common mistakes on the AZ-104 exam?
The recurring ones: misjudging RBAC scope inheritance, confusing NSG rule evaluation with firewall behavior, picking a redundancy option that ignores a stated constraint, and losing time on case studies. Many are reading errors as much as knowledge errors. Scenario questions usually bury one deciding constraint in the requirements, and skimming past it costs the mark.
How do the AZ-104 topics connect in a real project workflow?
The way they connect in production. You deploy a virtual machine into a virtual network, control who manages it with RBAC, attach a storage account, and monitor and back up the result. The exam mirrors this: case studies routinely need identity, networking, and storage decisions in a single scenario, which is why studying each domain in isolation only gets you partway.
What is an effective final-week review plan for AZ-104?
Drill your weakest domains instead of re-reading everything. Run one full timed practice test around midweek, review every question you missed, then stop adding new material. The day before, do a light pass over terminology and command syntax, nothing more. New topics crammed in the final 48 hours mostly trade sleep for confusion.
Is AZ-104 worth it in 2026?
For anyone administering Azure, yes. It validates the skills Azure admin roles use daily and is the required associate credential on the path to Azure Solutions Architect Expert (AZ-305). The certification renews free each year through an online assessment on Microsoft Learn, so the USD 165 exam fee is a one-time cost as long as you keep renewing.
Where does AZ-104 fit in the Microsoft Azure certification path?
AZ-900 (Azure Fundamentals) is the optional starting point; it isn't required. After AZ-104, the most common next step is AZ-305, which together with AZ-104 earns the Azure Solutions Architect Expert certification. Candidates heading into security typically take AZ-500 instead. The related exams below link to each.
Related Microsoft Azure Exams
The AZ-104 question bank is updated on a regular cycle to reflect how Microsoft actually tests, not only when the official syllabus changes. When Microsoft does revise the AZ-104 skills outline (most recently on April 17, 2026), we additionally re-check the affected questions and answers against current Microsoft Learn documentation. The current bank date is shown in the exam details at the top of this page.