AZ-104 Sample Questions With Answers

About these questions

These five questions are original. We wrote them in the style of the AZ-104 skills measured, one for each domain. They are not real exam questions, and the real exam will word things differently and may use other formats, such as drag and drop or interactive items. See the exam format page for what Microsoft says about question styles.

How to use these

Try each question without looking at notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it on the domains explained page.

Question 1 (Manage Azure identities and governance)

Resource group rg-payroll has a CanNotDelete lock. Priya has the Contributor role on rg-payroll. Which two actions can Priya perform? Choose two.

  • A. Remove the lock from rg-payroll
  • B. Update a tag on the virtual machine vm-pay01 in rg-payroll
  • C. Delete vm-pay01
  • D. View the configuration of vm-pay01
  • E. Delete rg-payroll
Show the answer and explanation

Correct answers: B and D. A CanNotDelete lock lets authorized users read and modify resources but blocks deletion, and child resources inherit it. Priya can therefore view vm-pay01 and update its tags. The closest wrong option is A. Contributor is a powerful role, so it is tempting to think it can remove a lock, but managing locks needs the lock permissions that Owner and User Access Administrator hold and Contributor does not. Options C and E are delete operations, which the lock blocks for everyone, whatever their role.

Question 2 (Implement and manage storage)

A maintenance script must update the CORS rules of both the Blob service and the Table service in storage account stinvoice01. You want to give it a single SAS token that covers both services. Which type of SAS should you create?

  • A. A user delegation SAS
  • B. A service SAS
  • C. A service SAS linked to a stored access policy
  • D. An account SAS
Show the answer and explanation

Correct answer: D. An account SAS can cover one or more storage services in one token, and it can delegate service-level operations such as setting service properties, which is where CORS rules live. A service SAS is limited to resources in one service, so it cannot span Blob and Table. Linking it to a stored access policy (option C, the closest wrong answer) gives you server-side control to revoke or change the token, but the scope stays the same. A user delegation SAS is signed with Microsoft Entra credentials and applies to specific Blob resources, not to service-level operations across services.

Question 3 (Deploy and manage Azure compute resources)

The Bicep file net.bicep declares one virtual network. Resource group rg-lab already contains a virtual machine named vm-lab01 and a storage account named stlab01, and neither appears in the file. You run `az deployment group create –resource-group rg-lab –template-file net.bicep` and do not set a deployment mode. What happens?

  • A. The virtual network is created or updated, and vm-lab01 and stlab01 are left unchanged
  • B. The virtual network is created, and vm-lab01 and stlab01 are deleted
  • C. The deployment fails because the resource group is not empty
  • D. Nothing is deployed because the command only previews the changes
Show the answer and explanation

Correct answer: A. Incremental is the default deployment mode. It creates or updates the resources in the file and leaves other resources in the resource group alone. Option B describes complete mode, the closest wrong option, which removes resources that are not in the file, but you have to ask for it explicitly. Deployments into a resource group that already has resources are normal, so C is wrong. Previewing is a separate operation called what-if, so a plain create command does deploy.

Question 4 (Implement and manage virtual networking)

Virtual network vnet-web is peered with vnet-hub, and virtual network vnet-data is also peered with vnet-hub. No other peerings, gateways, or network virtual appliances exist. Can a virtual machine in vnet-web connect to a virtual machine in vnet-data?

  • A. Yes, traffic passes through vnet-hub by default
  • B. No, peering is not transitive, so you need a direct peering or a routing appliance
  • C. Yes, if all three virtual networks are in the same region
  • D. Yes, if you enable Allow gateway transit on vnet-hub
Show the answer and explanation

Correct answer: B. A peering connects exactly two virtual networks, and traffic does not hop across a middle network by default. To connect vnet-web and vnet-data you can peer them directly, or send traffic through a network virtual appliance in the hub by using user-defined routes. Option D is the closest wrong answer. Gateway transit lets a peered network use a VPN or ExpressRoute gateway in the hub, which is a different goal and does not turn the hub into a router between spokes. Region does not change the transitivity rule, so C is wrong too.

Question 5 (Monitor and maintain Azure resources)

You need to protect the block blobs in storage account stdocs01 by using Azure Backup and a backup policy. Which resource must you create to hold the backup policy and the backup instance?

  • A. A Recovery Services vault
  • B. A Backup vault
  • C. A Log Analytics workspace
  • D. An Azure Automation account
Show the answer and explanation

Correct answer: B. Azure Backup uses two vault types. A Backup vault is used for newer workloads such as Azure Blobs, and it holds the policy and the backup instance. A Recovery Services vault, the closest wrong option, protects workloads such as Azure virtual machines and Azure Files, and it also hosts Site Recovery, but it is not the vault for blobs. A Log Analytics workspace stores logs and can feed backup reports. An Automation account runs runbooks, and Azure Backup does not need one here.

More guides for AZ-104

Next step

Missed one? Open the matching section on the domains explained page. When you want more practice with explained answers, our AZ-104 practice tests are original practice sets with 50 questions each.

Try the AZ-104 practice exams