Azure AZ-104 Practice Test

AZ-104 practice test: what's covered

• Azure Administrator Associate

Free AZ-104 sample questions

1. Your security team wants to require multifactor authentication only when sign-ins come from outside the corporate network. Which Microsoft Entra ID capability and license enables this?

   • A. Conditional Access policies, which require Microsoft Entra ID P1 or P2
   • B. Security defaults, available on the free Microsoft Entra ID tier
   • C. Per-user MFA configured individually on every member account
   • D. Azure Policy with a deny effect applied at the subscription scope
   Show answer

   Correct: A. Conditional Access evaluates signals such as named locations and grants or blocks access, and it requires Entra ID P1 or higher. Security defaults are free but enforce MFA for everyone with no location condition, so they cannot scope by network. Per-user MFA is all-or-nothing and not condition-aware, and Azure Policy governs Azure resources, not identity sign-in, so neither fits the requirement.

2. You must enforce that every storage account in a subscription uses only HTTPS and that the 'CostCenter' tag is present on all resource groups. Which Azure Policy components apply here? (Choose TWO)

   • A. A policy definition with the 'deny' effect to block noncompliant storage accounts
   • B. A policy with the 'modify' or 'append' effect to add the required tag automatically
   • C. A resource lock of type ReadOnly placed on the subscription root scope
   • D. An RBAC custom role assignment granting Storage Account Contributor rights
   • E. A management group hierarchy that automatically encrypts all storage keys
   Show answer

   Correct: A and B. Azure Policy uses a deny effect to reject resources that fail a condition such as missing HTTPS-only, and modify/append effects can add or remediate a required tag. A ReadOnly lock only prevents changes and does not evaluate compliance, RBAC controls who can act rather than enforcing configuration rules, and a management group is a scope container that does not encrypt keys, so those three are incorrect.

3. A help desk team needs to start, stop, and restart virtual machines in a resource group but must never be able to delete the VMs or change networking. Which assignment follows least privilege?

   • A. Assign the built-in Virtual Machine Contributor role at the resource group scope
   • B. Assign the Owner role at the subscription scope for full operational control
   • C. Assign the Reader role at the resource group scope to view the machines
   • D. Assign the Contributor role at the management group scope for the tenant
   Show answer

   Correct: A. Virtual Machine Contributor lets users manage VMs, including power operations, without granting access to delete the VNet or manage other resource types, and scoping it to the resource group limits blast radius. Owner and Contributor are far too broad and violate least privilege, whereas Reader is read-only and cannot start or stop a VM, so it is insufficient for the task.

4. After applying a CanNotDelete lock to a production resource group, an administrator reports they can still change settings on the resources inside it. Why is this expected behavior?

   • A. A CanNotDelete lock blocks deletion only and still permits read and update operations
   • B. Resource locks apply exclusively to the resource group object and never to child resources
   • C. Only a ReadOnly lock has any effect, and CanNotDelete locks are ignored by Azure
   • D. Locks take up to 24 hours to propagate before deletion protection becomes active
   Show answer

   Correct: A. CanNotDelete prevents deletion while allowing authorized users to read and modify resources, which is why settings can still change. Locks do inherit to child resources, so the second option is wrong; CanNotDelete is fully honored, unlike the third claim; and locks apply immediately rather than after a propagation delay, making the last option incorrect.

5. Your governance standard requires that resources automatically receive the 'Department' tag value set on their parent resource group. A new VM was created without the tag. What is the correct remediation approach?

   • A. Assign the 'Inherit a tag from the resource group' policy with a modify effect and remediate
   • B. Rely on tag inheritance, since resource group tags flow to child resources by default
   • C. Place a ReadOnly resource lock on the VM so the tag can no longer be removed
   • D. Move the VM to a management group, which copies tags down to all members
   Show answer

   Correct: A. Tags are not inherited automatically in Azure, so the built-in inherit-tag policy with a modify effect plus a remediation task is the supported way to apply the parent value to existing resources. Believing tags flow down by default is the common AZ-104 trap and is incorrect, a ReadOnly lock does not add tags, and management groups do not propagate tags to resources, so those options fail.

Last updated: 2026-10-19

AZ-104 practice test FAQ

Related practice tests

• AZ-900 practice test
• AZ-305 practice test
• AZ-700 practice test
• AZ-500 practice test
• AZ-204 practice test
• SAA-C03 practice test