Is this Microsoft Azure Administrator Practice Test mock test useful for entrance exam preparation?

Yes. It is designed for Microsoft Azure Administrator AZ-104 aspirants for chapter-wise revision, speed practice and AI-generated mock papers from previous-year style questions.

More Practice / Microsoft Azure Administrator AZ-104

Microsoft Azure Administrator Practice Test

This preparation material maps across the five functional areas of the AZ-104 exam syllabus. Networking leads the priority list at 25–30%, followed closely by Deploying and Managing Compute at 20–25%. Group management, identities, and governance account for 15–20%, while storage implementation spans 15–20%, leaving resource monitoring and backups to represent the final 10–15%. Expect virtual networks, subnet routing, and peering options to demand a major share of your focus.

Microsoft Azure Administrator AZ-104Azure InfrastructureAI practice test

Browse all competitive exams

About this Microsoft Azure Administrator AZ-104 Azure Infrastructure practice test

The AZ-104 certification sits at the heart of Microsoft's cloud curriculum because it evaluates practical execution over mere terminology. You are asked to act as the hands-on gatekeeper who configures network security group rules, troubleshoots peering connections, manages subscription locks, and scales out virtual machine sets. If you can navigate the Azure portal but struggle with the underlying implications of your changes, this situational mock test provides the missing link. We dig into the active decisions an administrator makes every day, with rich explanations decoding Microsoft's administrative logic.

Microsoft Azure Administrator Practice Test sample questions

These starter questions help you launch a azure infrastructure mock test quickly. Swap them with your own worksheet, notebook, or textbook questions any time.

1. A company wants to require multi-factor authentication only when users sign in from outside the corporate office network, while allowing normal sign-in from trusted locations. Which Azure AD feature should be used?
- A) An Azure AD Conditional Access policy with a location condition and a grant control requiring MFA
- B) A default MFA registration policy applied to all users
- C) An Azure Policy assignment at the subscription scope
- D) A Network Security Group rule blocking external IP ranges
2. An administrator wants to assign a user permission to manage virtual machines within a resource group but must ensure the user cannot delete the resource group itself. Which approach should the administrator use?
- A) Assign the Owner role at the resource group scope
- B) Assign the built-in Virtual Machine Contributor role at the resource group scope
- C) Assign the Contributor role at the subscription scope
- D) Add the user to the Global Administrator role in Azure AD
3. A company wants administrators to receive elevated access to a subscription only for a limited, approved time window, with justification required for each activation. Which Azure AD feature provides this?
- A) Conditional Access
- B) Azure AD Privileged Identity Management (PIM)
- C) Azure Policy
- D) Management Groups
4. An administrator wants to prevent a critical production resource from being accidentally deleted, even by a user who has Contributor permissions on it. What should be applied?
- A) A CanNotDelete resource lock
- B) An Azure Policy audit rule
- C) A read-only RBAC role
- D) A resource tag named "DoNotDelete"
5. A company manages several subscriptions under one management group and wants to guarantee that new resources can only be deployed into two approved Azure regions across all of them. What should be configured?
- A) A resource lock on each subscription
- B) An RBAC custom role restricting region selection
- C) An Azure Policy with an allowed locations definition assigned at the management group
- D) A Conditional Access policy scoped to the Azure portal
6. A finance team wants to see how much each department is spending on Azure resources inside a single shared subscription, without creating a separate subscription per department. What should the administrator implement?
- A) Separate management groups per department
- B) Resource tags identifying each department, reviewed through Cost Management + Billing
- C) A unique resource group naming convention only
- D) Azure Policy denying cross-department resource creation
7. A company needs its storage account data replicated to a secondary Azure region and wants applications to be able to read from that secondary region even while the primary region is healthy. Which redundancy option should it choose?
- A) Locally redundant storage (LRS)
- B) Zone-redundant storage (ZRS)
- C) Geo-redundant storage (GRS)
- D) Read-access geo-redundant storage (RA-GRS)
8. A company has compliance data that is almost never accessed, must be retained for seven years, and can tolerate several hours of retrieval time if it's ever needed. Which storage tier minimizes cost?
- A) Hot tier
- B) Cool tier
- C) Archive tier
- D) Premium SSD
9. A financial services company must guarantee that certain blobs cannot be modified or deleted by anyone, including administrators, for a fixed retention period, in order to meet a regulatory requirement. What should it configure?
- A) A CanNotDelete resource lock on the storage account
- B) A time-based immutability policy on the blob container
- C) Azure AD Conditional Access on the storage account
- D) Read-access geo-redundant storage
10. An administrator needs to efficiently copy a large number of blobs from one storage account to another without downloading them to a local machine first. Which tool is designed for this?
- A) Azure Storage Explorer's drag-and-drop only
- B) AzCopy
- C) Azure Backup
- D) Azure Site Recovery
11. A third-party application needs temporary, time-limited access to upload files to a specific private blob container, without being given the storage account access key. What should the administrator generate?
- A) A Shared Access Signature (SAS) scoped to the container with an expiry time
- B) A new storage account key
- C) An Azure AD Global Administrator account
- D) A public read-access policy on the container
12. A web application's virtual machines need to automatically increase or decrease in number based on CPU load, behind a load balancer. What should the administrator deploy?
- A) A single large VM resized manually
- B) A Virtual Machine Scale Set with autoscale rules
- C) An Availability Set
- D) Azure Container Instances
13. A company wants two VMs running the same application to stay available during both planned Azure host maintenance and an unplanned single-server hardware failure within the same datacenter. What should the administrator configure?
- A) Deploy both VMs to the same Availability Set with separate fault and update domains
- B) Deploy both VMs to the same physical host
- C) Enable Azure Backup on both VMs
- D) Attach both VMs to the same NSG
14. A developer wants to deploy a web application quickly and have Azure handle the underlying OS patching, scaling, and infrastructure. Which service should they use?
- A) Azure Virtual Machines
- B) Azure App Service
- C) Azure Container Registry
- D) Azure Bastion
15. A team needs to run a short-lived container for a batch job without provisioning a virtual machine or setting up an orchestrator. Which service fits best?
- A) Azure Kubernetes Service
- B) Azure Container Instances
- C) Azure Virtual Machine Scale Sets
- D) Azure App Service Plan (Windows)
16. A company runs a fault-tolerant batch workload that can be interrupted and wants to reduce VM compute costs as much as possible. Which VM purchasing option should it choose?
- A) Reserved VM Instances
- B) Azure Spot Virtual Machines
- C) Pay-as-you-go standard VMs
- D) Dedicated Hosts
17. A company wants its non-production development VMs to automatically shut down every night to reduce cost, without requiring anyone to remember to stop them manually. What should the administrator configure?
- A) A resource lock on the VMs
- B) The VM's auto-shutdown setting
- C) A Network Security Group rule
- D) Azure Policy denying VM creation after hours
18. An administrator needs to resize a running VM to a size that isn't available on the VM's current underlying hardware cluster. What must happen before the resize can complete?
- A) The VM's operating system disk must be re-encrypted
- B) The VM must be stopped (deallocated)
- C) The VM must be moved to a different resource group
- D) The VM's public IP must be removed
19. Two virtual networks in the same Azure region need to communicate privately using private IP addresses, without traffic going over the public internet. What should be configured?
- A) A Site-to-Site VPN Gateway between the VNets
- B) VNet Peering
- C) ExpressRoute
- D) A public Load Balancer connecting both VNets
20. An on-premises office needs an encrypted connection to an Azure VNet over the public internet. Which service should be deployed?
- A) VNet Peering
- B) A Site-to-Site VPN Gateway
- C) ExpressRoute
- D) Azure Bastion
21. A company needs a private, dedicated connection from its on-premises datacenter to Azure that does not traverse the public internet and offers higher reliability and lower latency than a VPN. Which service should it use?
- A) Site-to-Site VPN
- B) Point-to-Site VPN
- C) ExpressRoute
- D) VNet Peering
22. VMs within a VNet need to resolve a custom internal domain name to a private IP address, without exposing that name to the public internet. What should be configured?
- A) A public Azure DNS zone
- B) A Private DNS zone linked to the VNet
- C) An NSG rule allowing DNS traffic
- D) Azure Traffic Manager
23. An administrator needs to control which inbound and outbound traffic is allowed to reach a subnet, based on source, destination, port, and protocol. What should be configured?
- A) A Network Security Group
- B) Azure Firewall Policy
- C) Azure Front Door
- D) A Route Table only
24. A company wants users worldwide to be routed, via DNS, to whichever of its regional deployments currently offers the lowest network latency. Which service and routing method should be configured?
- A) Azure Load Balancer with round-robin
- B) Azure Traffic Manager with the Performance routing method
- C) A Network Security Group with priority rules
- D) Azure ExpressRoute with BGP routing
25. Traffic from a VM to an on-premises server isn't arriving as expected, and the administrator needs to check the effective security rules and next hop being applied to that traffic. Which tool should be used?
- A) Azure Cost Management
- B) Azure Network Watcher
- C) Azure Advisor
- D) Azure Monitor Workbooks
26. A company wants guaranteed SLA-backed protection against large-scale volumetric DDoS attacks, along with cost protection for resources scaled up during an attack. Which service tier should it enable?
- A) The DDoS protection built into every Azure VNet by default
- B) Azure DDoS Protection Standard (Network Protection)
- C) A Network Security Group with deny-all rules
- D) Azure Firewall Premium
27. A company wants to centralize log and performance data from multiple Azure resources so it can be queried using Kusto Query Language (KQL). What should it create?
- A) An Azure Storage account
- B) A Log Analytics workspace
- C) A Recovery Services vault
- D) An Azure Key Vault
28. An administrator wants to be notified automatically by email when a VM's CPU utilization exceeds 90% for 5 minutes. What should be configured?
- A) An Azure Monitor alert rule with an action group
- B) A resource lock
- C) An Azure Policy assignment
- D) A Network Security Group rule
29. An administrator needs to visualize the network topology of a VNet and confirm connectivity between two specific VMs in near real time. Which tool should be used?
- A) Azure Cost Management
- B) Azure Advisor
- C) Network Watcher's topology and connection monitoring
- D) Azure Blueprints
30. A company needs to review a historical record of who created, modified, or deleted resources in a subscription over the past 60 days. Which log should be reviewed?
- A) Azure Activity Log
- B) Diagnostic settings only
- C) NSG flow logs
- D) Azure Service Health

Syllabus & Core Topics

Azure Administrator exam domainsAzure identity and access managementAzure storage and compute servicesAzure virtual networkingAzure Monitor and diagnostics

Azure often provides three or four distinct mechanisms to achieve similar goals, making it essential to analyze them in contrast. Comparing role-based access control directly against Azure Policy, or mapping ExpressRoute capabilities beside standard VPN tunnels, builds the kind of structured understanding that pays off directly on test day.

✦

Why this practice page is useful

Standard governance tools easily blur together — grouping RBAC, Azure Policy rules, and subscription resource locks side by side here helps you identify exactly which one applies in a given scenario.
VNet Peering, virtual gateway routes, and ExpressRoute links are all highly visual network administrator tasks that are easy to mix up under pressure — these scenarios train you to spot routing problems accurately.
Azure questions often masquerade as ordinary storage or compute queries when they're actually testing budget-management or replication logic — these breakdowns expose that trap immediately.

Answer key & quick explanations

Short answers for the sample questions above. Use this to self-check before generating a fresh AI-built mock test.

1. A company wants to require multi-factor authentication only when users sign in from outside the corporate office network, while allowing normal sign-in from trusted locations. Which Azure AD feature should be used?
A) An Azure AD Conditional Access policy with a location condition and a grant control requiring MFA
Conditional Access policies evaluate signals like location, and can require MFA only when a condition is met — such as sign-in from outside a trusted named location — while leaving sign-in unchanged for trusted locations. A registration policy just enforces MFA setup, not conditional enforcement, Azure Policy governs resource configuration rather than sign-in behavior, and NSGs filter network traffic, not user authentication.
2. An administrator wants to assign a user permission to manage virtual machines within a resource group but must ensure the user cannot delete the resource group itself. Which approach should the administrator use?
B) Assign the built-in Virtual Machine Contributor role at the resource group scope
Virtual Machine Contributor grants the permissions needed to create and manage VMs but deliberately excludes the ability to delete the resource group itself or manage access, so it fits this requirement precisely. Owner would also allow deleting the resource group and assigning access, Contributor at the subscription scope is far broader than needed, and Global Administrator is an Azure AD role, not an Azure resource role.
3. A company wants administrators to receive elevated access to a subscription only for a limited, approved time window, with justification required for each activation. Which Azure AD feature provides this?
B) Azure AD Privileged Identity Management (PIM)
PIM lets you make a role assignment 'eligible' rather than permanent, so a user has to activate it — usually with justification, and optionally approval — for a limited, time-boxed window, which is exactly the just-in-time access model described. Conditional Access controls sign-in conditions, Azure Policy enforces resource configuration, and Management Groups organize subscriptions, none of which provide time-boxed elevation.
4. An administrator wants to prevent a critical production resource from being accidentally deleted, even by a user who has Contributor permissions on it. What should be applied?
A) A CanNotDelete resource lock
A CanNotDelete lock blocks deletion of a resource regardless of the RBAC permissions the user otherwise holds, which is exactly the extra safeguard needed here. Azure Policy audit rules only report on non-compliance rather than blocking actions, a read-only role would also block the legitimate management the user needs to do, and a tag is just metadata with no enforcement behavior.
5. A company manages several subscriptions under one management group and wants to guarantee that new resources can only be deployed into two approved Azure regions across all of them. What should be configured?
C) An Azure Policy with an allowed locations definition assigned at the management group
An Azure Policy definition with allowed locations, assigned at the management group, applies to every subscription underneath it and blocks deployments to any region outside the approved list. Resource locks only prevent deletion or modification of existing resources, a custom RBAC role controls who can act but not where resources can be created, and Conditional Access governs sign-in to the portal, not resource deployment location.
6. A finance team wants to see how much each department is spending on Azure resources inside a single shared subscription, without creating a separate subscription per department. What should the administrator implement?
B) Resource tags identifying each department, reviewed through Cost Management + Billing
Tagging resources by department and then filtering or grouping by those tags in Cost Management + Billing lets the finance team see per-department spend inside one subscription, without the overhead of separate subscriptions. Extra management groups are meant to organize subscriptions, not attribute cost within one, a naming convention alone isn't queryable by Cost Management, and Azure Policy doesn't produce cost reports.
7. A company needs its storage account data replicated to a secondary Azure region and wants applications to be able to read from that secondary region even while the primary region is healthy. Which redundancy option should it choose?
D) Read-access geo-redundant storage (RA-GRS)
RA-GRS replicates data to a secondary region, the same as GRS, but additionally exposes that secondary copy with a read-only endpoint, so applications can read from it even while the primary region is fully available. LRS and ZRS only replicate within the primary region, and plain GRS keeps the secondary copy but doesn't allow reads from it unless a failover occurs.
8. A company has compliance data that is almost never accessed, must be retained for seven years, and can tolerate several hours of retrieval time if it's ever needed. Which storage tier minimizes cost?
C) Archive tier
The Archive tier has the lowest storage cost of the three tiers and is built for data that's rarely accessed and can tolerate a rehydration delay of hours before it's readable again, matching this seven-year, rarely-accessed scenario exactly. Hot and Cool tiers cost more per GB and are meant for data accessed more frequently, and Premium SSD is a VM disk tier, not a blob access tier.
9. A financial services company must guarantee that certain blobs cannot be modified or deleted by anyone, including administrators, for a fixed retention period, in order to meet a regulatory requirement. What should it configure?
B) A time-based immutability policy on the blob container
A time-based immutability policy on a blob container makes objects WORM (write once, read many) for the configured retention period, so they can't be altered or deleted by anyone — including an account owner — until the retention period expires, which is what regulatory retention rules typically require. A CanNotDelete lock can still be removed by someone with sufficient permissions, Conditional Access governs sign-in rather than data mutability, and RA-GRS is about replication, not immutability.
10. An administrator needs to efficiently copy a large number of blobs from one storage account to another without downloading them to a local machine first. Which tool is designed for this?
B) AzCopy
AzCopy is a command-line tool built specifically for high-throughput copying of blobs and files directly between storage accounts (or to/from local disk), without needing to route data through a local machine's disk first. Storage Explorer's manual drag-and-drop is far slower for large volumes, Azure Backup protects data rather than copying it between accounts, and Site Recovery replicates VMs for disaster recovery, not arbitrary blob data.
11. A third-party application needs temporary, time-limited access to upload files to a specific private blob container, without being given the storage account access key. What should the administrator generate?
A) A Shared Access Signature (SAS) scoped to the container with an expiry time
A Shared Access Signature grants scoped, time-limited permissions — such as write access to one container for a few hours — without ever revealing the storage account's access key, which would otherwise grant full control over the entire account. Issuing a new account key is far too broad, a Global Administrator account has nothing to do with storage access, and a public read-access policy would expose the container to everyone, not just this application.
12. A web application's virtual machines need to automatically increase or decrease in number based on CPU load, behind a load balancer. What should the administrator deploy?
B) A Virtual Machine Scale Set with autoscale rules
A Virtual Machine Scale Set manages a group of identical VMs behind a load balancer and can automatically add or remove instances based on autoscale rules tied to metrics like CPU, which is exactly the elastic behavior described. A single manually-resized VM doesn't scale automatically, an Availability Set only provides fault/update domain distribution without autoscaling, and Container Instances don't apply to full VM-based workloads.
13. A company wants two VMs running the same application to stay available during both planned Azure host maintenance and an unplanned single-server hardware failure within the same datacenter. What should the administrator configure?
A) Deploy both VMs to the same Availability Set with separate fault and update domains
An Availability Set spreads VMs across separate fault domains (different racks/power/network) and update domains (different maintenance batches), so a hardware failure or planned host reboot doesn't take down both VMs at once. Placing both VMs on the same physical host would defeat the purpose, Azure Backup protects data rather than providing runtime availability, and an NSG only filters network traffic.
14. A developer wants to deploy a web application quickly and have Azure handle the underlying OS patching, scaling, and infrastructure. Which service should they use?
B) Azure App Service
Azure App Service is a fully managed platform (PaaS) that handles OS patching, scaling, and the underlying infrastructure, letting a developer just deploy code. Virtual Machines require the customer to manage the OS and patching, Container Registry only stores container images rather than running them, and Azure Bastion is a secure RDP/SSH gateway, unrelated to hosting a web app.
15. A team needs to run a short-lived container for a batch job without provisioning a virtual machine or setting up an orchestrator. Which service fits best?
B) Azure Container Instances
Azure Container Instances runs a single container (or container group) on demand, billed by the second, with no VM provisioning or orchestrator to configure, which fits a short-lived batch job well. AKS requires managing a Kubernetes cluster, Scale Sets run VMs rather than lightweight containers, and an App Service Plan is billed continuously and is meant for long-running web apps.
16. A company runs a fault-tolerant batch workload that can be interrupted and wants to reduce VM compute costs as much as possible. Which VM purchasing option should it choose?
B) Azure Spot Virtual Machines
Azure Spot VMs offer the largest discount off pay-as-you-go pricing by using Azure's spare capacity, with the trade-off that the VM can be evicted when Azure needs that capacity back — an acceptable trade for a fault-tolerant, interruptible batch workload. Reserved Instances and pay-as-you-go VMs cost more for this scenario, and Dedicated Hosts are priced for isolation and compliance needs, not for minimizing cost on interruptible work.
17. A company wants its non-production development VMs to automatically shut down every night to reduce cost, without requiring anyone to remember to stop them manually. What should the administrator configure?
B) The VM's auto-shutdown setting
The VM's auto-shutdown setting lets you schedule a daily time for the VM to stop automatically, with an optional notification beforehand, solving exactly this cost problem with no ongoing manual effort. A resource lock only prevents deletion or modification, not runtime state changes like starting or stopping, an NSG rule controls network traffic rather than power state, and Azure Policy denying creation wouldn't shut down VMs that already exist.
18. An administrator needs to resize a running VM to a size that isn't available on the VM's current underlying hardware cluster. What must happen before the resize can complete?
B) The VM must be stopped (deallocated)
Resizing to a VM size on a different hardware cluster requires the VM to be stopped and deallocated first, since Azure needs to move it to different underlying hardware that supports the new size; a running VM can only be resized within sizes available on its current cluster. Disk encryption, resource group, and public IP have no bearing on which hardware clusters support a given VM size.
19. Two virtual networks in the same Azure region need to communicate privately using private IP addresses, without traffic going over the public internet. What should be configured?
B) VNet Peering
VNet Peering connects two virtual networks directly over the Microsoft backbone network using private IP addresses, with no gateway or public internet path involved, which is the simplest and lowest-latency option for two VNets in the same region. A VPN Gateway adds encryption overhead and cost that isn't needed for two Azure VNets, ExpressRoute is for on-premises-to-Azure connectivity, and a public Load Balancer would route traffic over the internet rather than privately.
20. An on-premises office needs an encrypted connection to an Azure VNet over the public internet. Which service should be deployed?
B) A Site-to-Site VPN Gateway
A Site-to-Site VPN Gateway creates an encrypted IPsec tunnel between the on-premises network and the Azure VNet over the public internet, which is exactly the described requirement. VNet Peering only connects two Azure VNets, ExpressRoute is a private circuit that bypasses the public internet entirely rather than using it, and Azure Bastion provides browser-based RDP/SSH access, not site-to-site connectivity.
21. A company needs a private, dedicated connection from its on-premises datacenter to Azure that does not traverse the public internet and offers higher reliability and lower latency than a VPN. Which service should it use?
C) ExpressRoute
ExpressRoute provides a private, dedicated circuit between on-premises infrastructure and Azure through a connectivity provider, entirely avoiding the public internet, and typically offers more consistent latency and higher reliability than a VPN. Site-to-Site and Point-to-Site VPNs both travel over the public internet, and VNet Peering only connects Azure VNets to each other, not on-premises networks.
22. VMs within a VNet need to resolve a custom internal domain name to a private IP address, without exposing that name to the public internet. What should be configured?
B) A Private DNS zone linked to the VNet
An Azure Private DNS zone linked to a VNet lets resources resolve custom domain names to private IP addresses entirely within that VNet, without publishing anything to the public internet. A public DNS zone would expose the name publicly, an NSG rule only controls whether DNS traffic is allowed to flow, and Traffic Manager is a DNS-based traffic-routing service for public endpoints, not private internal name resolution.
23. An administrator needs to control which inbound and outbound traffic is allowed to reach a subnet, based on source, destination, port, and protocol. What should be configured?
A) A Network Security Group
A Network Security Group evaluates rules based on source, destination, port, and protocol to allow or deny traffic at the subnet or NIC level, which is exactly this control point. Azure Firewall Policy configures a separate managed firewall appliance rather than subnet-level NSG rules, Front Door is a global HTTP(S) reverse proxy, and a Route Table only controls where traffic is directed, not whether it's allowed.
24. A company wants users worldwide to be routed, via DNS, to whichever of its regional deployments currently offers the lowest network latency. Which service and routing method should be configured?
B) Azure Traffic Manager with the Performance routing method
Traffic Manager's Performance routing method uses DNS to direct each user to the Azure endpoint with the lowest network latency for them, which matches this exact requirement. Load Balancer with round-robin only distributes traffic within a single region rather than across regions, an NSG only filters traffic rather than routing it, and ExpressRoute is a private connectivity circuit, not a global traffic-routing service.
25. Traffic from a VM to an on-premises server isn't arriving as expected, and the administrator needs to check the effective security rules and next hop being applied to that traffic. Which tool should be used?
B) Azure Network Watcher
Network Watcher provides diagnostic tools like effective security rules and next hop, which show exactly which NSG rules and routes actually apply to traffic from a given VM, making it the right tool to troubleshoot this connectivity problem. Cost Management reports on spend, Advisor gives best-practice recommendations, and Monitor Workbooks visualize metrics and logs rather than performing this kind of network-path diagnostic.
26. A company wants guaranteed SLA-backed protection against large-scale volumetric DDoS attacks, along with cost protection for resources scaled up during an attack. Which service tier should it enable?
B) Azure DDoS Protection Standard (Network Protection)
DDoS Protection Standard adds tuned, always-on traffic monitoring, adaptive mitigation, a financial SLA guarantee, and cost protection credits if scaling out during a documented attack — capabilities the basic protection built into every Azure network doesn't include. The default infrastructure-level protection only covers common network-layer attacks with no SLA, an NSG can't absorb volumetric floods, and Azure Firewall Premium is an application/network firewall, not a DDoS mitigation service.
27. A company wants to centralize log and performance data from multiple Azure resources so it can be queried using Kusto Query Language (KQL). What should it create?
B) A Log Analytics workspace
A Log Analytics workspace is the container that stores log and performance data collected by Azure Monitor, and it's queried using Kusto Query Language (KQL), which is exactly the centralization and querying capability described. A storage account just stores raw data without a query engine built for logs, a Recovery Services vault is for backup and site recovery, and Key Vault stores secrets and certificates, not telemetry.
28. An administrator wants to be notified automatically by email when a VM's CPU utilization exceeds 90% for 5 minutes. What should be configured?
A) An Azure Monitor alert rule with an action group
An Azure Monitor alert rule, evaluated against a metric like CPU percentage and paired with an action group, automatically triggers a notification — such as an email — when the condition is met. A resource lock only prevents deletion or modification, Azure Policy enforces configuration compliance rather than sending alerts on performance thresholds, and an NSG rule only filters network traffic.
29. An administrator needs to visualize the network topology of a VNet and confirm connectivity between two specific VMs in near real time. Which tool should be used?
C) Network Watcher's topology and connection monitoring
Network Watcher includes a topology view and Connection Monitor that show how resources in a VNet are connected and continuously test reachability between specific endpoints, which is exactly this diagnostic need. Cost Management and Advisor don't provide network topology or connectivity testing, and Azure Blueprints is a governance packaging tool, unrelated to network diagnostics.
30. A company needs to review a historical record of who created, modified, or deleted resources in a subscription over the past 60 days. Which log should be reviewed?
A) Azure Activity Log
The Activity Log records subscription-level control-plane operations — who created, modified, or deleted a resource, and when — for up to 90 days by default, which covers this 60-day audit requirement directly. Diagnostic settings route resource-level telemetry (like VM metrics) rather than management operations, NSG flow logs record network traffic rather than resource changes, and Service Health reports on Azure service incidents, not administrative actions.

Curriculum Mapping & Learning Guide

Use this breakdown to identify which skills each question tests and guide post-test review.

Manage Azure Identities & Governance

Configuring Entra ID access boundaries, managing Multi-Factor Authentication triggers, auditing administrative actions, and managing subscription cost-tracking tags.

Storage & Compute Solutions

Selecting storage replication strategies, managing immutable file directories, scaling virtual machines, and implementing container runtimes.

Virtual Networking

Configuring hub-and-spoke VNet configurations, establishing network security rules, managing DNS name zones, and orchestrating gateway routing.

Monitoring & Telemetry

Interrogating data endpoints with KQL queries, configuring monitoring thresholds, using Network Watcher to find packet drops, and reviewing subscription operations.

Microsoft Azure Administrator AZ-104 Azure Infrastructure units covered

Chapter 1: Subscription Governance: Administering Entra ID resources, RBAC scopes, resource locks, and Azure Policy assignments.
Chapter 2: Resilient File Storage: Configuring hot/cool/archive storage tiers, container permissions, and optimizing file replication.
Chapter 3: Scalable Azure Compute: Building virtual machine scale sets, availability configurations, and hosting App Service projects.
Chapter 4: Hybrid Network Routing: Network security rules, VNet peering, and configuring VPN gateways.
Chapter 5: Monitoring Systems: Querying diagnostics with KQL, setting alert triggers, and running Network Watcher packet-trace diagnostics.

How to use this microsoft azure administrator practice test page

1. Click the Start Microsoft Azure Administrator Practice Test button to launch the setup.

2. Use the slider to choose your number of questions (from 5 to 30, default is 10).

3. Take your test, submit your answers, and let our AI analyze your performance.

4. Select Practice Weak Areas or Generate More Like This to have the AI create custom, targeted questions just for you.

Explore more for Microsoft Azure Administrator AZ-104

Move between subjects in the same exam to build a balanced Microsoft Azure Administrator AZ-104 revision routine.