The best predictor of an AZ-104 pass is not how many hours of video you have watched. It is whether you can pick the right action when a scenario hands you three plausible ones. These ten questions are written the way the Azure Administrator exam writes them: a short situation, a constraint that decides the answer, and distractors that are wrong for a specific reason.
Cover the answers, work through all ten, then read the explanations for the ones you missed. Keep score, because the table at the end tells you what to do next.
How to Use These
- Answer before you read the explanation. The value is in the reasoning, not the letter.
- Say why each wrong option is wrong. That is exactly what the exam rewards.
- Track misses by domain. Two misses in one domain is a study session, not bad luck.
- Watch your pace. A real paper gives you about two minutes per item.
Domain 1: Manage Azure Identities and Governance
Question 1
An engineer holds a custom role whose Actions include Microsoft.Compute/* and whose NotActions include Microsoft.Compute/virtualMachines/delete. The same engineer is a member of a group that holds Contributor at the subscription. Can the engineer delete a virtual machine in that subscription?
A. No, because NotActions explicitly denies the delete operation B. Yes, because effective permissions are the union of all role assignments C. No, because the most restrictive assignment always wins D. Yes, but only after the custom role assignment is removed
Answer: B. NotActions subtract permissions from the role that contains them. They are not a deny rule, and they have no effect on any other assignment. Effective permissions are the union of everything assigned to the user and to their groups, so Contributor still grants the delete. The only construct that overrides an allow is a deny assignment, which you cannot create directly through role assignments.
Question 2
An administrator assigns a Microsoft 365 E3 license to a newly created Microsoft Entra user. The assignment fails. The tenant has licenses available and the account is enabled. What is the most likely cause?
A. The user has no usage location set B. The user is a guest rather than a member C. The license must be assigned through a group rather than directly D. The user has not completed multifactor authentication registration
Answer: A. Some services are not available in every country or region, so Microsoft Entra ID refuses a license assignment until the user has a usage location. It is the first thing to check on a failed assignment for an otherwise healthy account. Direct assignment is perfectly valid, guests can hold licenses, and multifactor registration is unrelated.
Question 3
A company moves a subscription from one Microsoft Entra tenant to another after an acquisition. After the transfer, applications that used managed identities fail and no one can manage resources in the subscription. What happened?
A. The resources were moved to a new region during the transfer B. All Azure role assignments were removed and the system assigned managed identities have to be recreated in the new directory C. The subscription entered a disabled state until billing is reconfigured D. Resource locks were converted into deny assignments
Answer: B. Changing the directory of a subscription removes every Azure role assignment, because the principals lived in the old tenant. System assigned managed identities belong to the old directory too, so they have to be disabled and recreated, and Key Vault access policies that referenced those identities break with them. The repair is to recreate role assignments and managed identity configuration in the new directory, which is why this move is planned rather than improvised.
Domain 2: Implement and Manage Storage
Question 4
A storage account must keep serving reads if an entire Azure region becomes unavailable, and the team wants to read the replica without waiting for a failover. Which redundancy option meets the requirement?
A. Zone redundant storage (ZRS) B. Locally redundant storage (LRS) C. Read access geo redundant storage (RA-GRS) D. Geo redundant storage (GRS)
Answer: C. GRS copies data to the paired region, but the secondary is not readable until Microsoft or the customer initiates a failover. The read access variants, RA-GRS and RA-GZRS, expose a secondary endpoint you can read at any time. ZRS spreads copies across availability zones inside one region, which survives a zone failure but not a regional one, and LRS protects against nothing beyond a single datacenter rack.
Question 5
Security asks an administrator to disable Shared Key authorization on a storage account. Which access method continues to work after the change?
A. A service SAS that was signed with key1 B. An application using the account connection string C. A user delegation SAS created with Microsoft Entra credentials D. An account SAS signed with key2
Answer: C. Disabling Shared Key authorization blocks everything that relies on the account keys, which includes connection strings, account SAS tokens, and service SAS tokens, because all of them are signed with a key. A user delegation SAS is signed with a key requested from Microsoft Entra ID on behalf of a security principal, so it keeps working, as does direct Microsoft Entra access through the data plane roles.
Domain 3: Deploy and Manage Azure Compute Resources
Question 6
A virtual machine was deployed into availability zone 1. The workload owner now wants it in zone 2 to balance the estate. What is required?
A. Stop the virtual machine and change the zone in the availability settings B. Redeploy the virtual machine into zone 2, for example from a snapshot or an image C. Resize the virtual machine to a zone redundant size D. Move the virtual machine to a new resource group in zone 2
Answer: B. The availability zone of a virtual machine is fixed at creation, and so is membership of an availability set. Changing either means creating a new virtual machine, typically from a snapshot of the existing disks or from a captured image, and the managed disks and public IP address must land in the same zone as the new machine. Resource groups carry no zone or region constraint for the resources they hold, so moving groups changes nothing.
Question 7
An administrator applies the tag costCenter = 2040 to a resource group that contains twelve resources, then runs a cost report grouped by that tag. The report shows no cost for any of the twelve resources. Why?
A. Cost reports only support tags applied at subscription scope B. Tags on a resource group are not inherited by the resources inside it C. The tag name must be lowercase to appear in cost analysis D. Tag based reporting requires a policy assignment with the Audit effect
Answer: B. Resource group tags describe the group, not its contents. Resources are billed individually and only show a tag in cost analysis if the tag is on the resource itself. The usual fix is an Azure Policy assignment with the Modify effect that inherits the tag from the resource group, followed by a remediation task for the resources that already exist.
Domain 4: Implement and Manage Virtual Networking
Question 8
VNet1 and VNet2 are peered and the peering status is Connected in both directions. A virtual machine in VNet1 can reach a virtual machine in VNet2 by private IP address, but not by host name. Both networks use the default Azure provided DNS. What should the administrator do?
A. Enable Allow forwarded traffic on both sides of the peering B. Create a private DNS zone and link it to both virtual networks with auto registration enabled C. Add a user defined route for the remote address space D. Configure the virtual networks to use a custom DNS server in VNet1 only
Answer: B. Azure provided name resolution works inside a single virtual network and does not follow a peering. A private DNS zone linked to both networks, with auto registration on the links, gives virtual machines in either network a name they can resolve. The connectivity is already proven by the successful ping to the private IP address, so routing and peering flags are not the problem.
Question 9
A team deploys a Standard SKU public load balancer and tries to add an existing public IP address to the frontend configuration. The address does not appear in the list. What is the cause?
A. The public IP address uses the Basic SKU B. The public IP address is assigned dynamically C. The load balancer and the address are in different resource groups D. The public IP address has no DNS name label
Answer: A. Public IP SKUs must match the load balancer SKU, so a Standard load balancer accepts only Standard public IP addresses. Standard addresses are always statically allocated, which also rules out the dynamic allocation option. Resource groups are not a constraint, and a DNS name label is optional.
Domain 5: Monitor and Maintain Azure Resources
Question 10
A Recovery Services vault was created with locally redundant storage and has been backing up virtual machines for a month. The business now requires the ability to restore into the paired region. What should the administrator do?
A. Change the vault redundancy setting to geo redundant and enable cross region restore B. Create a new vault with geo redundant storage and start protecting the machines there C. Enable cross region restore, which changes the redundancy automatically D. Run an on-demand backup after enabling the soft delete feature
Answer: B. The redundancy setting of a Recovery Services vault can only be changed before the first item is protected. Once backups exist, the setting is locked, so reaching cross region restore means a new vault with geo redundant storage, protecting the machines there, and retiring the old vault when its retention allows. Cross region restore itself also requires geo redundant storage, so it cannot be switched on in a locally redundant vault.
Score Yourself
| Score | What it means |
|---|---|
| 9 to 10 | Strong. Move to full-length timed mocks and check your pacing. |
| 7 to 8 | Close. Rework the two domains you missed, then retest. |
| 5 to 6 | Keep studying. You know the services but not their defaults and side effects. |
| Below 5 | Go back to the study guide and hands-on practice before booking anything. |
The Four Mistakes Behind Most Misses
- Reading for keywords instead of constraints. Phrases such as least privilege, without affecting other users, and with the least administrative effort are the question, not decoration.
- Treating two services as interchangeable. Service endpoint and private endpoint, soft delete and versioning, availability set and availability zone. Each pair has one sentence that separates it. Learn the sentence.
- Ignoring what a feature breaks. Regenerating a key, applying a lock, disabling shared key access, moving a subscription. The exam loves consequences.
- Forgetting that some settings are creation only. Availability zone, vault redundancy, infrastructure encryption, hierarchical namespace. If it cannot be changed later, that is an exam question waiting to happen.
Next Steps
Ten questions is a diagnostic. The real paper pulls from a much wider bank, runs on a 100 minute clock, and reports a scaled score from 1 to 1000 with 700 as the bar.
Take the free 20-question AZ-104 practice test next. It is written at full exam depth with a complete explanation on every item and no signup required. When you are ready for the whole rehearsal, the Sailor.sh AZ-104 mock exam bundle gives you 8 timed 100-minute mock exams of 50 questions each plus that free sample, 420 unique questions in total, all scored on the same 1 to 1000 scale as the real exam.
For the wider context, read the AZ-104 exam guide 2026, and if difficulty is your worry, how hard is AZ-104 breaks down exactly where candidates lose points.