AZ-104 Microsoft Azure Administrator exam questions test your ability to manage Azure identities, storage, compute, networking, and monitoring; the five domains Microsoft uses to evaluate real-world Azure administration skills. Below, you’ll find 50+ free, original AZ-104 practice questions for 2026, organized by these exact domains, in multiple choice, multi-select, drag-and-drop, hotspot, and scenario formats. Each question includes the correct answer, a clear explanation, and a direct link to the official Microsoft Learn documentation, so you can study the reasoning behind every answer instead of memorizing a dump. You’ll also get the current 2026 exam blueprint, a free downloadable PDF, a free Azure sandbox setup guide, and instructions for turning this page into a self-graded interactive quiz. 

Why the 2026 AZ-104 Exam Matters

The Microsoft Certified: Azure Administrator Associate credential remains one of the highest-ROI certifications in the Microsoft ecosystem. Microsoft refreshed the AZ-104 skills-measured outline in April 2026, shifting domain weights and adding newer services like Azure Container Apps, expanded Bicep coverage, and updated Microsoft Entra ID terminology. Study material written before that update, including most exam dumps circulating online, is now testing the wrong version of the exam.

Passing AZ-104 signals that you can run the day-to-day work of an Azure environment: identities, compute, storage, networking, and monitoring. It’s the natural next step after AZ-900 and a stepping stone toward AZ-305 or AZ-400.

Quick Exam Facts (2026)

Exam Passing Tips That Actually Work

1. Build things, don’t just read about them. Spin up a resource group, deploy a VM, configure an NSG, and break things on purpose, you’ll remember the fix far longer than any flashcard.
2. Read the whole case study before answering. Later questions often depend on details buried in an earlier paragraph of the same scenario.
3. Watch for “most cost-effective” or “least administrative effort” qualifiers. Several choices are technically correct; only one satisfies the actual constraint.
4. Know your CLI/PowerShell equivalents on sight, az vm create, New-AzVM, and their Bicep/ARM counterparts.
5. Pace yourself: roughly 1.5–2 minutes per question, with a buffer for the case study or lab section.
6. Use Microsoft Entra ID terminology, not “Azure Active Directory”, the exam language has fully switched over.

Latest 2026 AZ-104 Exam Blueprint (Domains & Weights)

Microsoft’s April 2026 skills-measured outline organizes AZ-104 into five domains. Identity/governance and compute are the two heaviest domains, together they can account for up to half the exam, so prioritize them if your study time is limited, but don’t neglect the other three; Microsoft tests all five domains on every delivery.

Free PDF Download: All 52 Questions + Answer Key

Want to study offline or print flashcards for a commute? We’ve compiled every question on this page, plus the answer key and Microsoft Learn links, into a single, ad-free PDF.

Download the AZ-104 2026 Practice Questions PDF

The PDF mirrors the domain groupings below. Pair it with hands-on labsrather than memorizing answers in isolation, the real exam rephrases scenarios, it doesn’t repeat them verbatim.

50+ Original AZ-104 Practice Questions (2026 Edition)

Every question below is grouped by exam domain, numbered, and followed by a bolded correct answer, a plain-English explanation, and a direct link to the relevant Microsoft Learn article. None of these are exam dumps, they’re original scenarios written to test the same concepts the real exam covers.

Domain 1: Manage Azure Identities and Governance (14 Questions)

Q1. You need to create 200 new user accounts in Microsoft Entra ID in a single operation. What is the most efficient method?

• A) Create each user manually in the Entra admin center
• B) Use the “Bulk create” feature with a CSV template in the Microsoft Entra admin center
• C) Ask each user to self-register
• D) Use Azure Policy to generate the accounts

Explanation: Entra ID’s bulk operations let administrators upload a CSV of user attributes and create hundreds of accounts in one pass, which is far faster than manual creation and doesn’t require scripting knowledge.

Q2. Which two of the following are valid Azure RBAC role types? (Choose two)

• A) Owner
• B) Contributor
• C) Global Reader
• D) Conditional Access Administrator

Explanation: Owner and Contributor are built-in Azure RBAC roles that apply to resource management. Global Reader and Conditional Access Administrator are Microsoft Entra ID (directory) roles, not Azure RBAC roles, a common exam trap.

Q3. A user is a member of two Entra ID groups. Group A has been assigned the Reader role on a resource group, and Group B has been assigned the Contributor role on the same resource group. What is the user’s effective permission?

• A) Reader only
• B) Contributor (RBAC permissions are additive)
• C) The most restrictive role always wins
• D) Access is denied due to a conflict

Explanation: Azure RBAC is additive, when a principal has multiple role assignments, the effective permissions are the union of all assigned roles, so the user ends up with Contributor-level access.

Q4. For each statement about Azure Policy, select Yes if the statement is true, or No if it is false.

Explanation: Azure Policy enforces organizational standards and can trigger remediation tasks, but it governs what configurations are allowed, it does not replace RBAC, which governs who can act on resources.

Q5. Which feature would you use to prevent accidental deletion of a production virtual network, even by users with Owner access?

• A) Azure Policy audit effect
• B) A “Delete” resource lock
• C) Conditional Access
• D) A Reader role assignment

Explanation: Resource locks (CanNotDelete or ReadOnly) override RBAC permissions, meaning even an Owner cannot delete a locked resource until the lock is removed, making it the correct safeguard here.

Q6. Your company has five subscriptions under one Entra ID tenant and wants to apply a single cost-management policy across all of them at once. What should you use?

• A) Apply the policy to each subscription individually
• B) Create a management group and assign the policy there
• C) Use a resource group tag
• D) Configure Conditional Access

Explanation: Management groups sit above subscriptions in the hierarchy, letting administrators apply policies, RBAC, and compliance settings once and have them inherit down to every subscription and resource group beneath them.

Q7. You want a user to be able to reset passwords for other users but not manage subscriptions or billing. Which type of role should you assign?

• A) Azure RBAC Owner role
• B) A Microsoft Entra ID directory role (e.g., Helpdesk Administrator)
• C) Azure RBAC Contributor role
• D) A custom Azure Policy definition

Explanation: Password resets and user-management tasks are governed by Entra ID directory roles, not Azure RBAC, RBAC controls access to Azure resources like VMs and storage, while directory roles control identity administration.

Q8. Arrange the steps in the correct order to create and assign a custom RBAC role via Azure CLI.

Steps to order:

• Test the role by assigning it to a test user
• Define the role permissions in a JSON file
• Run az role definition create
• Assign the role using az role assignment create

Correct order:

1. Define the role permissions in a JSON file
2. Run az role definition create
3. Assign the role using az role assignment create
4. Test the role by assigning it to a test user

Explanation: Custom roles start as a JSON definition specifying allowed/denied actions and scope, are registered with az role definition create, then assigned to a principal, testing always comes last to validate the configuration works as intended.

Q9. Which Entra ID feature lets users reset their own forgotten passwords without contacting IT?

• A) Conditional Access
• B) Self-service password reset (SSPR)
• C) Privileged Identity Management (PIM)
• D) Entra ID Connect

Explanation: SSPR allows registered users to verify their identity through methods like email, phone, or an authenticator app and reset their password without helpdesk involvement, reducing support tickets.

Q10. An administrator needs elevated access to Azure resources only for two hours to complete a maintenance task, and that access should expire automatically. What should be configured?

• A) A permanent Owner role assignment
• B) A time-bound, just-in-time role activation via Privileged Identity Management (PIM)
• C) A resource lock
• D) A custom RBAC role with no expiration

Explanation: PIM enables “just-in-time” privileged access, eligible roles can be activated for a defined duration and automatically expire, minimizing the window of standing privileged access.

Q11. What is the effect of assigning the Contributor role to a user at the subscription level?

• A) The user can manage access for other users
• B) The user can create and manage all resource types within the subscription, but cannot grant access to others
• C) The user has read-only access
• D) The user can only manage storage resources

Explanation: Contributor grants full management rights over resources but explicitly excludes the ability to modify role assignments, that capability is reserved for the Owner or User Access Administrator roles.

Q12. Which two conditions can Conditional Access policies evaluate before granting sign-in access? (Choose two)

• A) User’s location (IP-based)
• B) Device compliance state
• C) The user’s manager
• D) The color scheme of the device

Explanation: Conditional Access can evaluate real-world signals such as user location, device compliance, sign-in risk, and application sensitivity to decide whether to grant, block, or require additional verification for access.

Q13. Your organization wants new subscriptions to automatically inherit a naming convention and tagging policy the moment they’re created. What is the best tool?

• A) Resource groups
• B) Azure Blueprints/Policy assigned at the management group level
• C) Individual resource tags applied manually
• D) Entra ID Connect

Explanation: Assigning policy definitions (or an initiative) at the management group level ensures every subscription placed under that group automatically inherits governance rules like naming and tagging, with no manual step required per subscription.

Q14. A former employee’s Entra ID account must be disabled immediately, but their manager wants the account preserved for 30 days in case mailbox data needs to be recovered. What should you do?

• A) Delete the account immediately
• B) Disable (“block”) sign-in on the account, then delete it after the 30-day period
• C) Change the password only
• D) Remove the account from all groups but leave sign-in enabled

Explanation: Blocking sign-in immediately revokes access while preserving the account and its associated data, giving administrators a grace period before permanent deletion, deletion moves the object to a 30-day recoverable state anyway, but blocking first is the safer immediate action.

Domain 2: Implement and Manage Storage (10 Questions)

Q15. Which replication option keeps three synchronous copies of data within a single region and is the least expensive redundancy tier?

• A) GRS (Geo-redundant storage)
• B) LRS (Locally-redundant storage)
• C) ZRS (Zone-redundant storage)
• D) RA-GRS (Read-access geo-redundant storage)

Explanation: LRS replicates data three times within a single datacenter and is the cheapest option, but it offers no protection against a datacenter-level outage, ZRS and GRS trade cost for wider protection.

Q16. You need to grant a third-party application temporary, time-limited read access to a single blob without sharing your storage account key. What should you generate?

• A) A storage account access key
• B) A Shared Access Signature (SAS) token
• C) An RBAC Owner role assignment
• D) A management certificate

Explanation: A SAS token grants delegated, time-bound access to specific storage resources with defined permissions (e.g., read-only) without exposing the account’s master keys, exactly the least-privilege solution this scenario calls for.

Q17. Which Azure storage service is best suited for hosting static website assets like HTML, CSS, and JavaScript files?

• A) Azure Files
• B) Azure Queue Storage
• C) Azure Blob Storage (static website hosting)
• D) Azure Table Storage

Explanation: Blob Storage supports a built-in static website hosting feature that serves HTML/CSS/JS directly over HTTP(S) from a $web container, making it a natural fit for lightweight static sites.

Q18. For each scenario, select the correct Blob access tier: Hot, Cool, or Archive.

Explanation: Tiering balances storage cost against retrieval cost and latency, Hot is optimized for frequent access, Cool for infrequent but still promptly-needed access, and Archive for rarely-accessed data where retrieval delay is acceptable.

Q19. You need a file share that can be mounted simultaneously by both on-premises servers (via SMB) and Azure VMs. Which service should you deploy?

• A) Blob Storage
• B) Azure Files
• C) Azure Disk Storage
• D) Azure NetApp Files only

Explanation: Azure Files provides fully managed SMB and NFS file shares that can be mounted concurrently from cloud VMs and on-premises machines, unlike Blob or Disk storage which don’t offer native SMB file-sharing semantics.

Q20. A storage account must automatically move blobs to the Cool tier after 30 days and delete them after 365 days, without manual intervention. What should you configure?

• A) Azure Backup policy
• B) A Blob lifecycle management rule
• C) Storage account firewall rule
• D) A SAS token with an expiry date

Explanation: Lifecycle management policies let you define rules that automatically transition or delete blobs based on age, matching this exact “move after 30 days, delete after 365” requirement without any manual process.

Q21. Which two of the following can restrict network access to a storage account? (Choose two)

• A) Storage account firewall rules (allowed IP ranges)
• B) Private endpoints
• C) Blob lifecycle policies
• D) Access tiers

Explanation: Storage account firewalls and private endpoints both control network-level access, firewalls allow specific public IP ranges, while private endpoints bring the storage account into a private VNet entirely, removing public exposure.

Q22. Which redundancy option should you choose if your application requires automatic failover to a paired region during a regional outage, with the ability to read from the secondary region even before failover?

• A) LRS
• B) ZRS
• C) RA-GRS (Read-access geo-redundant storage)
• D) Standard SSD

Explanation: RA-GRS replicates data to a secondary paired region and exposes it as read-only, so applications can read from the secondary region for resilience even before a full failover is triggered, GRS alone does not expose read access to the secondary.

Q23. What Azure Storage feature allows you to recover an accidentally deleted blob within a configured retention window?

• A) Immutable storage
• B) Soft delete for blobs
• C) Storage account encryption
• D) Lifecycle management

Explanation: Soft delete retains deleted blobs (or blob versions) in a recoverable state for a configured number of days, protecting against accidental deletion or overwrite without requiring a full backup restore.

Q24. Regulatory requirements state that certain audit log blobs must not be modified or deleted for seven years, even by an administrator. What should you configure?

• A) A resource lock
• B) A time-based immutability policy (legal hold or retention policy) on the container
• C) Soft delete
• D) A SAS token

Explanation: Immutable blob storage policies (time-based retention or legal hold) enforce WORM (write once, read many) behavior at the storage layer, blocking deletion or modification even by account owners until the retention period expires, resource locks and soft delete don’t provide this guarantee.

Domain 3: Deploy and Manage Azure Compute Resources (14 Questions)

Q25. Which Azure service automatically adjusts the number of VM instances in a group based on CPU load or a defined schedule?

• A) Azure App Service
• B) Virtual Machine Scale Sets (VMSS)
• C) Azure Container Instances
• D) Azure Functions Premium plan

Explanation: VM Scale Sets let you deploy and manage identical, auto-scaling VMs behind a load balancer, scaling out or in based on metrics like CPU usage or a schedule, ideal for workloads with variable demand.

Q26. You need to deploy a containerized web app with built-in autoscaling and support for KEDA-based event-driven scaling, without managing the underlying Kubernetes cluster. What should you use?

• A) Azure Kubernetes Service (AKS)
• B) Azure Container Apps
• C) Azure Container Instances
• D) Azure App Service with a custom container

Explanation: Azure Container Apps is a serverless container platform built on Kubernetes and KEDA that supports event-driven autoscaling (including scale-to-zero) without exposing or requiring management of the underlying cluster, a key addition to the April 2026 exam outline.

Q27. Which deployment file format does Microsoft now recommend over ARM JSON templates for infrastructure as code on Azure?

• A) Terraform HCL
• B) Bicep
• C) YAML pipelines
• D) PowerShell DSC

Explanation: Bicep is Microsoft’s own domain-specific language that compiles down to ARM JSON but is more concise and readable; it’s the recommended, exam-emphasized approach for authoring Azure infrastructure as code in 2026.

Q28. Arrange the steps in the correct order to deploy a VM using a Bicep file via Azure CLI.

Steps to order:

• Sign in with az login
• Write the .bicep file defining the VM resource
• Create a resource group (if it doesn’t exist)
• Run az deployment group create referencing the Bicep file

Correct order:

1. Sign in with az login
2. Create a resource group (if it doesn’t exist)
3. Write the .bicep file defining the VM resource
4. Run az deployment group create referencing the Bicep file

Explanation: Authentication and a target resource group must exist before deployment; the Bicep file defines what gets deployed, and az deployment group create is the command that actually submits the template to Azure Resource Manager.

Q29. A team wants to run a short-lived, single container for a batch job without provisioning a VM or orchestrator. Which service is the best fit?

• A) Azure Kubernetes Service
• B) Virtual Machine Scale Sets
• C) Azure Container Instances (ACI)
• D) Azure App Service

Explanation: ACI is designed for simple, isolated container workloads that need to start quickly and run without the overhead of an orchestrator, a perfect match for short-lived batch jobs.

Q30. You need to move a running VM from the Standard_D2s_v3 size to Standard_D4s_v3 to handle more load. What is required?

• A) The VM can be resized instantly with zero downtime
• B) The VM typically must be stopped/deallocated if the target size isn’t available on the current hardware cluster, then resized
• C) A new VM must always be created from scratch
• D) Resizing is only possible during initial VM creation

Explanation: Azure will attempt an in-place resize, but if the requested size isn’t available on the VM’s current hardware cluster, the VM must be stopped and deallocated before the resize can complete, a nuance the exam frequently tests.

Q31. Which Azure Compute option is best for hosting a fully managed .NET web application with built-in deployment slots for staging and production, without managing servers or containers directly?

• A) Azure Container Apps
• B) Azure App Service
• C) Azure Virtual Machines
• D) Azure Batch

Explanation: App Service is a fully managed PaaS offering purpose-built for web applications and APIs, including deployment slots that let you stage a new version and swap it into production with minimal downtime.

Q32. Which two actions can you take to reduce compute costs for a dev/test VM that’s only needed on weekdays? (Choose two)

• A) Configure auto-shutdown for evenings and weekends
• B) Use Azure Reservations only for always-on production workloads, and pay-as-you-go for this VM
• C) Delete the VM every night and recreate it manually
• D) Upgrade to a larger VM size

Explanation: Auto-shutdown schedules stop VM billing for compute during off-hours without deleting the resource, and reserving capacity only makes financial sense for workloads that run continuously, a part-time dev/test VM is better left on pay-as-you-go pricing with scheduled shutdown.

Q33. For each Azure compute option, select whether it supports automatic scale-to-zero (Yes) or not (No).

Explanation: Container Apps and Functions on the Consumption plan can scale down to zero instances when idle, eliminating cost during inactivity, while ACI and VMSS always run at least one active instance once started.

Q34. Which availability feature protects VMs from a single hardware failure by distributing them across separate fault domains and update domains within one datacenter?

• A) Availability Zones
• B) Availability Sets
• C) Azure Site Recovery
• D) VM Scale Sets flexible orchestration only

Explanation: Availability Sets group VMs into fault domains (separate hardware/power) and update domains (separate host-OS-update timing) within a single datacenter, protecting against localized hardware or maintenance failures, distinct from Availability Zones, which protect against datacenter-level failures.

Q35. Your application requires 99.99% SLA and must survive the complete loss of an Azure datacenter within a region. What deployment approach meets this?

• A) A single VM
• B) An Availability Set
• C) VMs deployed across multiple Availability Zones
• D) A VM with Standard SSD storage

Explanation: Availability Zones are physically separate datacenters within a region, each with independent power and networking; deploying across at least two zones is what unlocks the 99.99% SLA and protects against a full datacenter outage, Availability Sets only protect against in-datacenter failures.

Q36. Which ARM template/Bicep concept lets you deploy a set of resources multiple times with different parameters using a single deployment call?

• A) Nested templates
• B) Loops (using the for expression)
• C) Outputs
• D) Conditions

Explanation: The for loop expression in Bicep (and the copy element in ARM JSON) allows a single resource block to be deployed multiple times, for example, creating five identically configured VMs, without duplicating the resource definition.

Q37. What is the primary benefit of using deployment stacks when managing Bicep-based infrastructure?

• A) They automatically encrypt VM disks
• B) They track and manage the lifecycle of a group of resources as a single unit, including cleanup of removed resources
• C) They replace the need for resource groups
• D) They enable live migration between regions

Explanation: Deployment stacks (added to the 2026 outline) group resources deployed together so that when a resource is removed from the template, the stack can automatically clean up (“deny settings” and deletion) the corresponding Azure resource, simplifying infrastructure lifecycle management.

Q38. Which VM extension would you use to run a custom PowerShell or Bash script automatically on first boot?

• A) Network Watcher extension
• B) Custom Script Extension
• C) Azure Monitor Agent
• D) Guest Configuration extension

Explanation: The Custom Script Extension downloads and executes scripts on VM startup or on demand, commonly used to bootstrap software installation or configuration immediately after provisioning.

Domain 4: Implement and Manage Virtual Networking (10 Questions)

Q39. Which Azure service provides secure RDP/SSH access to VMs directly through the Azure portal without exposing a public IP on the VM?

• A) VPN Gateway
• B) Azure Bastion
• C) Network Security Group
• D) ExpressRoute

Explanation: Azure Bastion is a fully managed PaaS service that provides browser-based RDP/SSH connectivity over TLS directly through the portal, eliminating the need for a public IP or exposed management port on the target VM.

Q40. Two VNets in different regions need to communicate as if they were on the same network, with low latency and no public internet traversal. What should you configure?

• A) Two separate VPN Gateways with site-to-site tunnels
• B) VNet peering
• C) A public load balancer
• D) Azure Bastion

Explanation: VNet peering connects two virtual networks directly through the Microsoft backbone network (even across regions with global peering), providing low-latency, private connectivity without routing traffic over the public internet.

Q41. Which component filters inbound and outbound traffic to a subnet or network interface based on rules you define?

• A) Azure Firewall only
• B) Network Security Group (NSG)
• C) Azure Bastion
• D) Load Balancer

Explanation: NSGs contain security rules that allow or deny traffic based on source/destination, port, and protocol, and can be applied at the subnet or NIC level, the fundamental building block of Azure network segmentation.

Q42. For each traffic type, select whether a public Azure Load Balancer (Layer 4) can route it (Yes) or not (No).

Explanation: Azure Load Balancer operates at Layer 4 (TCP/UDP) and distributes traffic based on IP/port, but it cannot inspect HTTP content, perform SSL offloading, or route by URL path, those Layer 7 capabilities require Application Gateway instead.

Q43. Which DNS record type maps a domain name to an IPv4 address?

• A) CNAME
• B) A record
• C) MX record
• D) TXT record

Explanation: An A record maps a hostname directly to an IPv4 address, which is the most basic and commonly tested DNS record type, CNAME maps to another hostname, MX routes mail, and TXT holds arbitrary text data like verification tokens.

Q44. A subnet contains VMs that should be able to reach the internet, but you don’t want to assign public IPs to each VM. What should you deploy?

• A) Azure Bastion
• B) A NAT gateway
• C) A private endpoint
• D) An internal load balancer

Explanation: NAT Gateway provides outbound-only internet connectivity for resources in a subnet using a shared, static public IP, so individual VMs never need their own public IP for outbound access.

Q45. Which tool would you use to diagnose why traffic between two VMs in the same VNet is being unexpectedly blocked?

• A) Azure Advisor
• B) Network Watcher’s IP flow verify / NSG diagnostics
• C) Azure Cost Management
• D) Azure Policy compliance report

Explanation: Network Watcher provides diagnostic tools like IP flow verify and NSG flow logs that pinpoint exactly which security rule is allowing or denying a specific traffic flow, making it the go-to troubleshooting tool for connectivity issues.

Q46. What is the purpose of a service endpoint on a subnet?

• A) It assigns a public IP to every resource in the subnet
• B) It extends a VNet’s private address space and identity to an Azure PaaS service, keeping traffic on the Azure backbone
• C) It replaces the need for NSGs
• D) It enables VPN connectivity to on-premises networks

Explanation: Service endpoints let you secure Azure service resources (like a storage account) to a specific VNet/subnet by routing traffic over the Azure backbone network rather than the public internet, while still using the service’s public endpoint address.

Q47. Which two of the following are valid VPN Gateway SKUs used to determine throughput and features? (Choose two)

• A) VpnGw1
• B) VpnGw2
• C) Standard_D2s_v3
• D) Premium_LRS

Explanation: VpnGw1–VpnGw5 (and their AZ variants) are the SKU tiers for Azure VPN Gateway, determining throughput, tunnel count, and BGP support, the other two options are a VM size and a storage redundancy tier, unrelated to VPN Gateway.

Q48. A private endpoint has been configured for a storage account inside a VNet. What is the primary security benefit?

• A) It increases the storage account’s read throughput
• B) It gives the storage account a private IP address within the VNet, removing it from public internet exposure entirely
• C) It automatically enables geo-replication
• D) It replaces the need for a firewall

Explanation: Unlike service endpoints, private endpoints assign the PaaS resource an actual private IP inside your VNet, allowing you to disable public network access entirely and route all traffic privately, the strongest network isolation option for PaaS services.

Domain 5: Monitor and Maintain Azure Resources (8 Questions)

Q49. Which Azure Monitor component lets you write Kusto Query Language (KQL) queries against collected log data?

• A) Metrics Explorer
• B) Log Analytics workspace
• C) Action Groups
• D) Application Insights Live Metrics

Explanation: A Log Analytics workspace stores log data collected by Azure Monitor and exposes it for KQL querying, powering everything from custom dashboards to alert rules based on log patterns.

Q50. You want your on-call team to receive both an email and an SMS the moment CPU usage on a critical VM exceeds 90% for five minutes. What two components must you configure together?

• A) A Log Analytics workspace and a Blob container
• B) An alert rule with a defined condition, linked to an action group containing email/SMS notifications
• C) A resource lock and a tag
• D) Azure Advisor recommendations

Explanation: Alert rules define the condition/threshold to monitor (like CPU > 90% for five minutes), while action groups define what happens when the alert fires, combining them is the standard pattern for notification-based monitoring.

Q51. Which backup component in Azure stores backup data and manages backup policies for VMs, SQL databases, and file shares?

• A) Azure Site Recovery vault
• B) Recovery Services vault
• C) Storage account container
• D) Log Analytics workspace

Explanation: A Recovery Services vault is the management entity for Azure Backup, storing recovery points and backup policies for VMs, SQL Server in Azure VMs, Azure Files, and more, all in one place.

Q52. Your company needs a disaster recovery plan that replicates entire on-premises VMs to Azure so they can be failed over during a site-wide outage, with minimal data loss. Which service should you implement?

• A) Azure Backup
• B) Azure Site Recovery (ASR)
• C) Blob lifecycle management
• D) Availability Sets

Explanation: Azure Site Recovery continuously replicates VMs (from on-premises or between Azure regions) and orchestrates failover/failback, making it the purpose-built disaster recovery tool, Azure Backup, by contrast, protects against data loss/corruption rather than site-wide outages.

Interactive Quiz: Test Yourself Before Exam Day

Reading explanations is useful, but active recall, being forced to answer before seeing the solution, is what actually cements the material. Here’s how to turn this article into a self-graded quiz in under ten minutes:

1. Create a Google Form. Add each question above as a multiple-choice item, using the same answer options.
2. Enable the quiz setting. In Google Forms, go to Settings → Make this a quiz, then mark the correct answer and paste in the explanation text as “answer feedback” for each question.
3. Set it to show scores immediately after submission so you get instant feedback rather than waiting.
4. Randomize question order (under Settings → Presentation) each time you retake it, so you’re recalling concepts rather than memorizing position.
5. Track your weak domains. Google Forms’ response summary shows which questions were missed most often, cross-reference those against the five domains above and spend extra lab time there.

If you’d rather not build your own form, embed this article’s questions into any free quiz platform (Google Forms, Microsoft Forms, or a simple HTML quiz widget), the goal is forcing an active answer before you see the explanation.

Free Azure Sandbox Setup Guide

You can’t reliably pass AZ-104 from theory alone. Here’s how to get hands-on practice for free:

1. Sign up for an Azure free account, new accounts get credit for 30 days plus a set of services free for 12 months, enough for lab work if you shut resources down after each session.
2. Use Microsoft Learn sandboxes. Many Learn modules include a temporary, pre-authenticated Azure sandbox so you can complete labs without touching your own subscription.
3. Set a budget alert immediately in Cost Management (50%/80%/100% thresholds) so you’re never surprised by a bill.
4. Build a “practice lab” resource group and tear it down after each session, this keeps costs near zero and builds the muscle memory the exam’s live-lab questions reward.
5. Prioritize the two heaviest domains: create Entra ID users/groups and assign RBAC roles, then deploy a VM via the portal, CLI, and Bicep so you recognize all three approaches.
6. Practice deleting things too, cleanup (removing a peering, a lock, a scale set) is tested as often as creation.

Success Story + Bonus Tips

“I failed AZ-104 once studying purely from question dumps. The second attempt, I passed with a 780 by switching to hands-on labs and cross-checking every answer against Microsoft Learn”, a pattern reported often across Azure study communities, and the reasoning behind linking every explanation on this page back to official documentation instead of an anonymous answer key.

Bonus tips for exam week:

• Redo your weakest domain the night before, not your strongest, confidence in what you already know doesn’t move your score.
• Schedule the exam when you’re naturally sharpest, not squeezed between meetings.
• Read every option fully, AZ-104 often hides a “second-best” distractor to catch fast readers.
• In a case study, don’t panic on the first hard question, you can usually revisit it later in that section.
• Renew early. The certification lasts one year with a free renewal assessment; set a calendar reminder before it opens.

Frequently Asked Questions FAQ’s

Is AZ-104 hard to pass in 2026?

It’s a moderate-to-challenging associate-level exam, not conceptually hard, but its scenario and case-study format trips up candidates who memorize facts instead of practicing in a real Azure environment.

How many questions are on the AZ-104 exam?

Typically 40–60 questions in 100 minutes, combining multiple-choice, multi-select, drag-and-drop, hotspot, and case-study formats, with an occasional live lab.

What is the passing score for AZ-104?

700 out of a scaled 1000-point range, so there’s no simple “percentage correct” target, not every question is weighted identically.

Are AZ-104 exam dumps reliable?

No, they’re frequently outdated (especially after the April 2026 update), can contain wrong answers, and risk violating Microsoft’s exam policies. Original, explanation-backed questions like these are safer and more effective.

How long should I study for AZ-104?

Most candidates with some Azure/IT background spend 6–10 weeks; complete beginners may need closer to 3 months.

Do I need AZ-900 before attempting AZ-104?

Not a hard prerequisite, but foundational cloud knowledge from AZ-900 makes AZ-104 concepts click faster if you’re new to Azure.

What changed in the April 2026 AZ-104 update?

Identities/governance rose to 20–25% weight, networking dropped to 15–20%, and the outline added Azure Container Apps, deployment stacks, expanded Bicep coverage, and full Microsoft Entra ID terminology.

Can I retake AZ-104 if I fail?

Yes, a 24-hour wait before a second attempt, 14 days before a third, and a longer mandatory wait after that, with a new fee each time.

Is AZ-104 worth it for a career change into cloud administration?

Yes, it’s a widely recognized, practically-focused signal for Azure administrator, cloud support, and junior DevOps roles.