AZ-104 Practice Questions: Real Scenario Types From the Exam Pool

Here are 8 multiple-choice questions designed to match the style, difficulty, and domain coverage of the AZ-104 exam. --- These questions test your practical knowledge of managing Microsoft Azure subscriptions, identities, storage, networking, and compute resources. Treat them like the real exam—read carefully, eliminate wrong answers, and think about the "why" behind each solution.

Question 1

You have a virtual machine (VM) named VM1 that runs a mission-critical application. You need to ensure that VM1 is automatically restarted if the underlying physical host fails. You also need to receive an alert if the VM is unavailable for more than 5 minutes. What should you implement? Another useful resource: AZ-104 in 8 Weeks: Study Plan for Azure Administrators.

1. A. Azure Site Recovery (ASR) and Azure Service Health alerts.
2. B. Azure Monitor alerts and Azure Service Health alerts.
3. C. Azure Site Recovery (ASR) and an Availability Zone.
4. D. Azure Monitor alerts and an Availability Set.

Answer: B

Explanation: Azure Monitor can detect when a VM is unavailable (via heartbeat signals) and trigger an alert, while Azure Service Health alerts you about service issues impacting your resources. Azure Site Recovery is for disaster recovery (replicating to another region), not for automatic restart on host failure. Availability Zones/Sets protect against hardware failure but do not provide the alerting mechanism required by the question.

Question 2

You have a storage account named sa1 that contains a blob container. You need to ensure that blobs in this container are immutable and cannot be deleted or overwritten for a period of 5 years for compliance purposes. You also need to allow legal investigations to place temporary holds on specific blobs. What should you configure?

1. A. Enable a retention policy for the container using a "Time-based retention" policy.
2. B. Enable versioning for the container and configure a lifecycle management rule.
3. C. Apply a legal hold policy to the container.
4. D. Configure a soft delete policy for the container.

Answer: A

Explanation: A time-based retention policy on an immutable blob storage container ensures that blobs cannot be deleted or overwritten for a set number of years. A legal hold is a separate, indefinite hold used for litigation, but the question specifies a fixed 5-year period and the ability to add legal holds. Versioning and lifecycle management do not provide immutability. Soft delete just protects against accidental deletion, not overwrites.

Question 3

You have an Azure subscription that contains a virtual network named VNet1. You need to allow VMs in VNet1 to access Azure Storage and Azure SQL Database without sending traffic over the public internet. You also need to ensure that a network administrator can monitor the traffic flow between the VMs and these services. What should you implement?

1. A. Azure Private Endpoints and Network Watcher.
2. B. Azure Service Endpoints and Network Watcher.
3. C. Azure Private Endpoints and Azure DNS Private Resolver.
4. D. Azure Service Endpoints and Azure Firewall.

Answer: B

Explanation: Service Endpoints provide a secure, direct connection to Azure services (like Storage and SQL) over the Azure backbone network, without using the public internet. Network Watcher (specifically NSG flow logs) allows you to monitor traffic flow. Private Endpoints also provide private connectivity but use a private IP in your VNet, which is more complex and not specifically required here, and they don't inherently provide the same level of flow monitoring without additional configuration. Related reading: AZ-104 Cheat Sheet: Every Domain, Every Key Service, One Page.

Question 4

You have a virtual machine scale set (VMSS) named ScaleSet1 that runs a web application. The application experiences a sudden spike in CPU usage. You need to ensure that ScaleSet1 automatically adds instances when CPU usage exceeds 80% for 10 minutes. What should you configure?

1. A. A scale-in policy based on a custom metric.
2. B. A scale-out policy based on a custom metric.
3. C. A scale-out policy based on a scheduled rule.
4. D. A scale-in policy based on a scheduled rule.

Answer: B

Explanation: To automatically add instances (scale out) based on CPU usage, you must configure a scale-out rule that uses a metric (in this case, the "Percentage CPU" metric) with a threshold of 80% and a duration of 10 minutes. A scale-in policy removes instances. A scheduled rule is for scaling based on a pre-defined time, not real-time metrics.

Question 5

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1 that hosts several VMs. You need to ensure that traffic from Subnet1 to the internet is blocked, while traffic to a specific on-premises network is allowed via a Site-to-Site VPN. What should you configure?

1. A. Configure a route table with a route for 0.0.0.0/0 to the virtual network gateway, and associate it with Subnet1.
2. B. Configure a network security group (NSG) with a rule that denies all outbound traffic, and associate it with Subnet1.
3. C. Configure a route table with a route for 0.0.0.0/0 to the virtual network gateway, and a route for the on-premises IP range to the internet.
4. D. Configure a network security group (NSG) with a rule that denies all internet-bound traffic, and associate it with Subnet1.

Answer: A

Explanation: To force all internet-bound traffic (0.0.0.0/0) through the VPN gateway (and block it from going directly out to the internet), you use a User-Defined Route (UDR) that sets the next hop for 0.0.0.0/0 to the virtual network gateway. This is known as forced tunneling. An NSG cannot block traffic based on "internet" as a destination (it uses IP ranges), and it would also block the on-premises traffic if applied broadly.

Question 6

You have a user named User1 who is an Azure Active Directory (Azure AD) administrator. You need to grant User1 the ability to manage Azure AD users and groups, but only for users and groups in a specific organizational unit (OU) that you will create. What should you do?

1. A. Assign User1 the Global Administrator role.
2. B. Assign User1 the User Administrator role.
3. C. Create an administrative unit and assign User1 the User Administrator role scoped to that unit.
4. D. Create a management group and assign User1 the User Administrator role scoped to that group.

Answer: C You might also find GCP Professional Cloud Architect Difficulty: Why Case Studies Are the Real Boss helpful.

Explanation: Administrative Units (AUs) allow you to delegate Azure AD administration to a specific subset of users and groups, rather than the entire directory. By creating an AU and assigning the User Administrator role scoped to it, User1 can only manage the users and groups within that AU. Global Administrator or User Administrator at the directory level grants too broad access. Management groups are for managing Azure resources, not Azure AD objects.

Question 7

You have a Linux virtual machine (VM) named VM1. You need to apply a custom security baseline configuration to VM1, and you need to ensure the configuration is applied every time the VM starts. What should you use?

1. A. Azure Policy with a Guest Configuration assignment.
2. B. A custom script extension that runs on first boot.
3. C. An Azure Automation State Configuration (DSC) pull server.
4. D. Azure Desired State Configuration (DSC) extension with a configuration that is reapplied on reboot.

Answer: D

Explanation: The Azure DSC extension can be used to apply a configuration to a VM. By setting the RebootNodeIfNeeded and using a configuration that is designed to be idempotent, the DSC extension will reapply the configuration on every boot (when triggered by the VM agent). Azure Policy Guest Configuration is for auditing, not necessarily for enforcing a reapplication on every boot. A custom script extension runs once on first boot. A pull server is a more complex setup, but the DSC extension is the direct answer for applying the configuration at startup.

Question 8

You have an Azure subscription that contains a resource group named RG1. RG1 contains a storage account named sa1 and a virtual network named VNet1. You need to ensure that only VMs connected to VNet1 can access sa1. What should you configure?

1. A. Configure a private endpoint for sa1 in VNet1.
2. B. Configure a service endpoint for sa1 in VNet1.
3. C. Configure sa1's firewall to allow access only from the VNet1's public IP address.
4. D. Configure sa1's firewall to allow access only from the VNet1's service endpoint.

Answer: D

Explanation: To restrict access to a storage account to a specific VNet, you configure the storage account's firewall and virtual network settings. You enable the service endpoint for Microsoft.Storage on the subnet in VNet1, and then add that subnet to the storage account's firewall rules. A private endpoint is a more granular approach (assigns a private IP), but the question specifically asks about restricting access from the VNet, which is the classic "Enable service endpoint and add to firewall" scenario. Option C is incorrect because VNet1 doesn't have a single public IP for all VMs.

---

These questions cover key areas like identity management, storage configuration, networking, and compute scalability. Remember to review the official Microsoft Learn documentation on Azure Monitor, Network Watcher, and Azure Policy to deepen your understanding of these core concepts. Good luck with your preparation!

If you are still mapping out your revision, a free AZ-104 study plan can give you a schedule that fits your weekly availability.

Make your revision count — Microsoft Azure Administrator (AZ-104) practice test highlight exactly what you need to revisit.

When you want to check which areas need more attention, a free AZ-104 readiness check offers a quick look at your weakest topic with explanations for every question.