Description
For learners studying for Microsoft Certified: Azure Administrator Associate
What you'll learn
Practice pack content
Domain 1 - Manage Azure identities and governance
Domain 2 – Implement and manage storage
Domain 3 – Deploy and manage Azure compute resources
Domain 4 – Implement and manage virtual networking
Domain 5 – Monitor and maintain Azure resources
Final Exam Simulators
Exam Study Guide
Interactive Flashcards
Try 3 Azure Administrator AZ-104 practice questions
Choose an answer, explore the explanation, and see why the other options are less suitable. Three short scenarios. No sign-in required.
1. Least-privilege access for an audit team
An Azure subscription contains Finance-Prod and Marketing-Test resource groups. An audit team must inspect the configurations of all Azure resources in Finance-Prod but must not modify them or gain access to Marketing-Test. The team has no other role assignments. Which Azure RBAC assignment best meets these requirements?
Answer and full explanation
Correct answer: D — Reader at the Finance-Prod resource group scope.
Why D is correct
The Azure Reader role grants permission to view resource configurations without allowing modifications. Assigning it at the Finance-Prod resource group scope covers resources within that group through scope inheritance. It does not automatically grant access to the separate Marketing-Test resource group. This meets the audit team’s visibility requirement while limiting both the permission level and its scope. Reader is a control-plane role, so reading protected application data may require separate data-plane permissions.
Why the other options are less suitable
- A — Subscription-wide Reader: Reader at subscription scope would let the auditors inspect resources in both resource groups. Although it is read-only, its scope is broader than the requirement allows.
- B — Resource-group Contributor: Contributor at the Finance-Prod scope would permit changes to many resources. The audit team only needs to inspect configuration, not manage resources.
- C — Storage Blob Data Reader: This role authorizes reading blob data within its assigned scope, rather than inspecting all Azure resource configurations. It would not provide the required visibility into every resource in Finance-Prod.
Key takeaway: Match both the Azure RBAC role and its assignment scope to the access needed; Reader is not the same as data-plane access.
Read two more sample questions
2. Revoking partner access to blobs
An administrator issues read-only service SAS tokens to a supplier for blobs in one Azure Storage container. Security may need to revoke all tokens issued under that supplier’s policy before their expiration, without rotating account keys or interrupting other suppliers. Which approach best supports this requirement?
Answer and full explanation
Correct answer: C — Service SAS linked to a supplier-specific stored access policy.
Why C is correct
An Azure Blob Storage container can have a stored access policy associated with service SAS tokens. The policy provides server-side control over permissions and expiry for signatures linked to it. An administrator can revoke that group of tokens by deleting the policy, changing its identifier, or setting its expiry in the past. Using a supplier-specific policy avoids rotating the shared storage account key and invalidating unrelated SAS tokens. This design requires the administrator to associate the tokens with the policy when issuing them.
Why the other options are less suitable
- A — Ad hoc service SAS: A short-lived ad hoc service SAS can reduce exposure when early revocation is unnecessary. Without a stored access policy, selectively revoking it before expiry is not supported.
- B — Account SAS and key rotation: Rotating the signing account key can invalidate account SAS tokens. It can also disrupt other clients relying on that key and does not offer supplier-specific revocation.
- D — User delegation SAS and RBAC removal: User delegation SAS tokens support Microsoft Entra-based signing and have their own revocation mechanism. Removing the signing principal’s RBAC assignment does not reliably invalidate SAS tokens that have already been issued.
Key takeaway: Associate a service SAS with a stored access policy when selective early revocation is required without rotating account keys.
3. Private blob access from Azure virtual machines
A virtual machine application in an Azure virtual network reads blobs from a storage account. Company policy requires a private IP address for that connection and prohibits traffic through the storage account’s public endpoint. The application must continue using the usual storage hostname. Which configuration should the administrator choose?
Answer and full explanation
Correct answer: A — Blob private endpoint, private DNS, and disabled public network access.
Why A is correct
An Azure Storage private endpoint gives the blob service a private IP address within an Azure virtual network. Proper private DNS configuration lets the normal blob service hostname resolve to the private endpoint for clients on that network. Disabling public network access prevents clients from reaching the storage account through its public endpoint. This combination satisfies both the private connectivity and hostname requirements. The administrator must still configure appropriate authentication and authorize the private endpoint connection.
Why the other options are less suitable
- B — Service endpoint with public access disabled: A service endpoint provides a secure route to the service’s public endpoint and can work with network firewall rules. It does not supply a private IP address for the storage service and does not meet the disabled-public-endpoint requirement.
- C — Storage firewall with public access enabled: Allowing a subnet through the storage firewall can restrict access when service endpoints are configured. Traffic still targets the public service endpoint rather than the private IP required here.
- D — Private DNS without a private endpoint: A private DNS zone helps resolve names to private resources when those resources actually exist. DNS configuration alone cannot create the private network interface or connectivity required to reach Blob Storage.
Key takeaway: Use a blob private endpoint together with private DNS and public network access restrictions for private Azure Storage connectivity.
Preview complete
You have tried all three samples
Review the explanations or try the samples again. This short preview covers only a small part of the exam objectives.
Your sample score resets when this page reloads.
Your practice pack includes
More ways to make each study session count
Focus on a topic, practise under a time limit, or return to the supporting resources before your next attempt.
Domain-based practice
Timed practice sets
Study guide
Flashcards
Requirements
- Microsoft recommends familiarity with operating systems, networking, servers, virtualization, and experience with Azure PowerShell, Azure CLI, Azure portal, ARM templates or Bicep, and Microsoft Entra ID.
- If Azure RBAC, SAS access policies, or private networking are unfamiliar, combine question practice with Microsoft Learn and hands-on exercises in Azure subscriptions that you are authorized to manage.
- You need an internet-connected device, a current web browser, and an ExamsDigest account to access this online practice product. No offline access, Azure subscription, or hosted labs are implied.
Know the exam you’re studying for
These details describe Microsoft's official AZ-104: Microsoft Azure Administrator exam.
What our students say
“I was struggling with Azure networking and RBAC permissions while studying for AZ-104. The ExamsDigest practice questions helped me understand how to choose the right configurations in different scenarios. The explanations were clear and showed me exactly what I needed to review.”
Michael Reynolds
✓ Verified Review
“The practice exams covered a good range of Azure administration topics. I found the questions about virtual machines, storage accounts, and private endpoints particularly helpful. I also liked that the incorrect answers were explained instead of just showing the correct option.”
Jennifer Collins
✓ Verified Review
“I had already completed several Microsoft Learn modules, but I wanted more practice applying what I'd studied. ExamsDigest helped me identify my weak areas in Azure Monitor, networking, and resource management. The scenario-based questions made the concepts easier to understand.”
Robert Hayes
✓ Verified Review
Your questions, answered.
Which Microsoft certification exam does this practice target?
These examples target AZ-104: Microsoft Azure Administrator, associated with the Microsoft Certified: Azure Administrator Associate certification. The official study guide identifies skills measured as of April 17, 2026. Before purchasing, compare the product’s confirmed contents with Microsoft’s current objectives for your examination date and language. The three preview questions alone do not establish that every question in the paid pack has been independently audited against the complete blueprint.
Who is Azure Administrator AZ-104 practice suitable for?
AZ-104 is intended for intermediate-level Azure administrators responsible for implementing, managing, securing and monitoring cloud environments. Relevant knowledge includes networking, operating systems, virtualization, Microsoft Entra ID, Azure Storage and virtual machines. Microsoft recommends familiarity with the Azure portal, PowerShell, Azure CLI, and ARM or Bicep deployments. Learners with limited cloud administration experience should combine practice questions with foundational study and authorized hands-on exercises.
How should I combine AZ-104 practice questions with hands-on experience?
Use practice questions alongside Microsoft Learn and exercises in Azure environments you are authorized to administer. Assign Azure RBAC roles at different scopes, configure storage access controls, deploy virtual machines, and explore private endpoints and Azure Monitor alerts. These activities connect technical concepts with practical administrative decisions. They are independent study recommendations and do not imply that Azure subscriptions, cloud credits, hosted labs, or training environments are included with the practice pack.
What should I do after answering an AZ-104 practice question incorrectly?
Identify the specific requirement your selected answer failed to satisfy. For example, distinguish resource-group RBAC from subscription-wide access, service SAS policies from ad hoc tokens, or private endpoints from service endpoints. Read the explanations for all four options, revisit the relevant Microsoft documentation and attempt another scenario involving the same concept. Focus on administrative reasoning rather than memorizing answer letters or interpreting a practice score as an official passing prediction.
Does this preview reproduce the official AZ-104 examination format?
No. The preview contains three original scenarios, each with four choices and one correct answer. Microsoft’s official AZ-104 examination is proctored, lasts 100 minutes and may contain interactive components or different question formats. Microsoft offers an examination sandbox to demonstrate the testing interface. These examples represent a small selection of the published objectives and do not reproduce the full examination experience or establish every feature included in the paid practice pack.
Does completing this practice earn the Azure Administrator Associate certification?
No. Purchasing or completing independent practice questions does not award Microsoft’s Azure Administrator Associate certification. Candidates must pass the official AZ-104 examination and satisfy Microsoft’s applicable credential requirements. Microsoft’s associate-level role-based certifications are subject to annual renewal. ExamsDigest practice access and official examination registration are separate activities. Check the product’s confirmed commercial terms rather than assuming that an examination voucher or official booking is included.
30-day conditional refund policy
Eligible requests must be made within 30 calendar days, with no more than 20% of any included simulator completed. The purchase must not already be refunded or under a payment dispute or chargeback. Other provisions apply; mandatory consumer rights remain unaffected.
Useful links for your preparation
