Free Exam AZ-104: Microsoft Azure Administrator Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Exam AZ-104: Microsoft Azure Administrator practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In the Microsoft Entra admin center, which action creates an internal user account in the tenant?

   1. A. Select New user, then Create new user under Entra ID > Users.
   2. B. Select New user, then Invite external user under Entra ID > Users.
   3. C. Select Groups, then Add dynamic query for a user membership rule.
   4. D. Select Password reset, then enable SSPR for the user.

   Answer: A

   Explanation: The user creation procedure says "Browse to Entra ID > Users." and "Select New user > Create new user." The other actions invite a guest, define group membership, or enable password reset rather than create an internal user.

   Reference: How to create, invite, and delete users in Microsoft Entra ID — Create a new user

2. 2A storage firewall allows requests from a particular subnet. Does that network rule alone authorize a client to read blobs?

   1. A. No; the client must also meet the storage account's authorization requirements.
   2. B. Yes; an allowed subnet bypasses all data authorization.
   3. C. Yes; but only if the account uses Microsoft Entra authentication.
   4. D. No; the client must always use an account SAS, regardless of identity.

   Answer: A

   Explanation: Microsoft notes, "Clients that make requests from allowed sources must also meet the authorization requirements of the storage account." A firewall rule controls network reachability; it is not a data authorization grant.

   Reference: Configure Azure Storage firewalls and virtual networks — Azure Storage firewall rules, Note

3. 3An ARM JSON template must accept a different storage account name for each deployment. Which template section defines a value supplied at deployment time?

   1. A. parameters.
   2. B. variables.
   3. C. outputs.
   4. D. resources.

   Answer: A

   Explanation: The ARM template syntax guide defines parameters as "Values that are provided when deployment is executed to customize resource deployment." Variables are calculated within the template; outputs return results; resources specify what to deploy.

   Reference: Understand the structure and syntax of ARM templates — Template format, parameters

4. 4Two subnets are planned inside one Azure virtual network. How must their address ranges relate?

   1. A. They must not overlap.
   2. B. They must be identical.
   3. C. One must contain the other.
   4. D. They must use different IP versions.

   Answer: A

   Explanation: "The range must be unique within the address space and can't overlap with other subnet address ranges in the virtual network." Subnet ranges in a VNet must be distinct.

   Reference: Add, change, or delete a virtual network subnet — Subnet address range

5. 5An administrator needs regularly sampled numeric values for an Azure resource. Which Azure Monitor data type should be examined?

   1. A. Metrics
   2. B. Activity log events
   3. C. Resource tags
   4. D. Role assignments

   Answer: A

   Explanation: "Metrics are numerical values that are collected at regular intervals and describe some aspect of a system at a particular time." Metrics are numeric time-series values.

   Reference: Azure Monitor Metrics overview — Overview

6. 6An administrator needs to grant a partner employee guest access to a workforce tenant. Which user operation fits that purpose?

   1. A. Create an internal member user with the partner's email address.
   2. B. Invite an external guest user from Entra ID > Users.
   3. C. Convert an existing security group to Dynamic Device membership.
   4. D. Enable password reset for all tenant users.

   Answer: B

   Explanation: The guidance distinguishes the operations: "This article explains how to create a new user, invite an external guest, and delete a user in your workforce tenant." Inviting an external guest fits a partner employee; the alternatives change account type, group membership, or password reset.

   Reference: How to create, invite, and delete users in Microsoft Entra ID — Introduction and Invite an external user

7. 7When allowing a virtual network subnet through Azure Storage network rules, what must also be enabled on that subnet for the documented service-endpoint path?

   1. A. A Virtual Network service endpoint.
   2. B. An Azure Bastion host.
   3. C. A public load balancer.
   4. D. An application security group.

   Answer: A

   Explanation: The storage network guidance says, "In the subnet's virtual network settings, you must also enable a Virtual Network service endpoint." The other services do not establish the subnet's service endpoint for storage.

   Reference: Configure Azure Storage firewalls and virtual networks — Virtual network rules

8. 8An ARM JSON template should return the deployed endpoint URL to the caller. Which template section is intended for values returned after deployment?

   1. A. outputs.
   2. B. parameters.
   3. C. variables.
   4. D. metadata.

   Answer: A

   Explanation: The ARM template guide describes outputs as "Values that are returned after deployment." Parameters take input, variables hold template values, and metadata describes the template rather than returning a deployed value.

   Reference: Understand the structure and syntax of ARM templates — Template format, outputs

9. 9What is the smallest IPv4 CIDR range Azure permits for a virtual network subnet?

   1. A. /29
   2. B. /28
   3. C. /30
   4. D. /27

   Answer: A

   Explanation: "The smallest range you can specify is /29, which provides eight IP addresses for the subnet." A /29 is the minimum supported range; /28 and /27 are larger ranges, while /30 is smaller and unsupported.

   Reference: Add, change, or delete a virtual network subnet — Subnet address range

10. 10Do Azure resource platform metrics require an administrator to create a diagnostic setting before collection begins?

    1. A. No; platform metrics are collected automatically.
    2. B. Yes; every platform metric requires a setting.
    3. C. Only if the resource is in a resource group.
    4. D. Only after a Log Analytics query is created.

    Answer: A

    Explanation: "Platform metrics are collected automatically from Azure resources. They require no configuration and have no ingestion or storage cost." A diagnostic setting is needed for export, not initial collection.

    Reference: Azure Monitor Metrics overview — Metric implementations