Prepstellar
Get the app

AZ-104 · Mock exam · 25 questions

AZ-104 mock exam: 25 free practice questions

Untimed here · timed and scored in the app

A free AZ-104 practice test with 25 exam-style questions drawn from the whole course and weighted by domain like the exam guide. Answer at your pace and read why each option is right or wrong.

  • 700 or greaterPassing score
  • Manage Azure identities and governance 20–25%
  • Implement and manage storage 15–20%
  • Deploy and manage Azure compute resources 20–25%
  • Implement and manage virtual networking 15–20%
  • Monitor and maintain Azure resources 10–15%

Exam details from the vendor’s exam guide, captured 2026-08-30.

Swipe, scroll or use ← →

  1. Q1 / 25

    Which pricing-plan choice is documented for a registry that requires private-endpoint connectivity and increased image throughput?

    1. ASelect Premium for both capabilities.
    2. BSelect Standard and enable Unsecure DNL.
    3. CSelect Premium and disable repository tags.
    4. DUse Standard for both needs.
    Show the answer

    Premium is the tier associated with higher image throughput and capabilities such as private-endpoint connectivity; Standard is sufficient for most ordinary workflows.

    Next → 1 / 25

  2. Q2 / 25

    A project needs a shared mailbox and SharePoint site, must include external collaborators, and should add employees automatically when Department equals Marketing. Which configuration best meets the requirements?

    1. AA security group with Dynamic User membership
    2. BA Microsoft 365 group with Dynamic User membership
    3. CA security group with Dynamic Device membership
    4. DA Microsoft 365 group with Assigned membership
    Show the answer

    The collaboration resources and external participants select Microsoft 365, while the Department rule requires Dynamic User membership.

    Next → 2 / 25

  3. Q3 / 25

    Which deployment slot can App Service back up and restore when an app uses the Basic tier?

    1. AAny nonproduction slot
    2. BThe most recently created slot
    3. CThe production slot
    4. DA cloned staging slot
    Show the answer

    Basic supports backup and restore for production alone; higher supported tiers are needed when protection must extend beyond that slot.

    Next → 3 / 25

  4. Q4 / 25

    Which storage-account change enforces Microsoft Entra authorization instead of Shared Key authorization?

    1. AStore both access keys in Key Vault and keep Shared Key enabled
    2. BKeep accepting account keys and assign a file ACL
    3. CRegenerate only the primary access key and keep Shared Key enabled
    4. DDisable Shared Key authorization on the storage account
    Show the answer

    Key rotation and secure storage improve key handling, but disabling Shared Key is the control that requires the identity path.

    Next → 4 / 25

  5. Q5 / 25

    Which role has read-only access to Cost Management alerts?

    1. ACost Management Reader
    2. BCost Management Contributor
    3. COwner
    4. DContributor
    Show the answer

    Reader and Cost Management Reader can view alerts, while the three listed management roles can read and update them.

    Next → 5 / 25

  6. Q6 / 25

    Where is a virtual network service endpoint enabled?

    1. AOn a subnet, where it covers any compute instance running in that subnet
    2. BOn the Azure service resource, through its IP firewall configuration
    3. COn a user-defined route that points at the address prefixes of the service
    4. DOn the network interface of each virtual machine that reaches the service
    Show the answer

    The endpoint is a single selection at subnet level; adding the virtual network rule on the service resource is the second step that secures it, and the more specific route appears on its own once the endpoint exists.

    Next → 6 / 25

  7. Q7 / 25

    A production machine has to start being billed to a different subscription in the same Microsoft Entra tenant. Its data has to stay in the current Azure region, and the service it hosts cannot go offline. Which approach fits?

    1. AA Resource Manager move of the machine and its dependencies to the other subscription
    2. BAn Azure Resource Mover job that targets the other subscription together with a new region
    3. CRebuilding the machine in the other subscription from an exported template
    4. DA region move to a nearby region, followed by a move into the other subscription
    Show the answer

    Two constraints decide this: the physical location has to stay put and the workload has to keep answering, and only the management-plane operation satisfies both, since it rewrites ownership without touching where the resource runs.

    Next → 7 / 25

  8. Q8 / 25

    Which name satisfies the documented requirements for a new Azure storage account?

    1. AA subscription-unique name of 3 to 24 lowercase letters and hyphens
    2. BA globally unique name of 3 to 24 lowercase letters and numbers
    3. CA globally unique name of 3 to 63 mixed-case letters and numbers
    4. DA resource-group-unique name of 1 to 24 lowercase letters and numbers
    Show the answer

    Storage account naming is global rather than subscription- or resource-group-scoped, and the allowed characters and length are both constrained.

    Next → 8 / 25

  9. Q9 / 25

    How deep can management groups be nested below the Tenant Root Group?

    1. ASix levels, excluding the root and subscription levels
    2. BSix levels when the root and subscription levels are included
    3. CTen levels, excluding resources but including all resource groups
    4. DTen thousand levels, with one level for each supported management group
    Show the answer

    The hierarchy supports six management-group levels beneath the root; subscriptions are not counted in that depth.

    Next → 9 / 25

  10. Q10 / 25

    Which record should an administrator query with nslookup to verify that public-domain delegation points to the new Azure DNS zone?

    1. AA manually created TXT ownership record
    2. BA manually created MX mail record
    3. CThe load balancer's A record set
    4. DThe automatically created SOA record
    Show the answer

    The SOA record represents the domain and provides the reference point used to confirm that the delegation now reaches the Azure DNS zone.

    Next → 10 / 25

  11. Halfway, at your pace

    In the app the mock exam is timed and scored like the real thing.

    Get the app

  12. Q11 / 25

    A machine, its managed disks, and its network resources are spread across three resource groups in one subscription, and the machine has to change subscription. What comes first?

    1. AConsolidating the dependencies into one resource group so they move together
    2. BMoving the machine alone, since dependencies follow their parent resource
    3. CMoving each dependency on its own, beginning with the managed disks
    4. DDeleting the dependencies and recreating them in the destination subscription
    Show the answer

    A cross-subscription move takes a resource together with its dependencies from a single resource group, which is why scattered dependencies force a consolidation step before the real move.

    Next → 11 / 25

  13. Q12 / 25

    Which retention range can be configured for Azure Files soft delete?

    1. AFrom 200 through 365 share-level copies
    2. BFrom 1 through 365 days
    3. CFrom 0 through 30 hours
    4. DFrom 366 through 730 days
    Show the answer

    Azure Files soft delete retains deleted shares for a configurable number of days within this range; the point-in-time-copy count is a separate protection limit.

    Next → 12 / 25

  14. Q13 / 25

    A failover has completed and the recovered VM has been verified. Which action finalizes the failover and deletes the source VM recovery points?

    1. AChange the recovery point
    2. BRun another test failover
    3. CClean up the source environment
    4. DCommit the completed failover
    Show the answer

    Commit is the irreversible completion step for the failover and removes the source VM recovery points after validation.

    Next → 13 / 25

  15. Q14 / 25

    Which Microsoft Entra admin center action starts creation of a cloud user?

    1. AGroups > New group starts group creation.
    2. BOpen Directory + Subscription, select a directory, and then choose Switch.
    3. COpen Users, select New user, and then select Create new user.
    4. DOpen Deleted users, select Restore user, and then confirm the dialog.
    Show the answer

    User creation begins from the Users surface; the other paths manage groups, deleted accounts, or directory context.

    Next → 14 / 25

  16. Q15 / 25

    Which DNS record type maps a host name to an IPv4 address?

    1. AA TXT record
    2. BAn MX record
    3. CAn A record
    4. DAn AAAA record
    Show the answer

    An A record provides the direct host-name-to-IPv4 mapping; AAAA serves IPv6, MX serves mail routing, and TXT associates text with a name.

    Next → 15 / 25

  17. Q16 / 25

    Which statement correctly contrasts the two Virtual Machine Scale Sets orchestration modes?

    1. AUniform and Flexible both require identical images, sizes, and configurations for every instance
    2. BUniform permits different images, sizes, or configurations within one scale set; Flexible requires one shared base image and configuration
    3. CUniform uses one base image and configuration; Flexible permits different images, sizes, or configurations
    4. DUniform controls autoscale schedules; Flexible controls only CPU-based autoscale rules
    Show the answer

    The orchestration choice governs instance homogeneity and is fixed at scale-set creation; autoscale triggers are a separate configuration decision.

    Next → 16 / 25

  18. Q17 / 25

    How do the documented minimum storage durations compare across the blob access tiers?

    1. ACool starts at 7 days, Cold starts at 30 days, and Archive starts at 90 days
    2. BHot starts at 30 days, Cool starts at 90 days, and Cold starts at 180 days
    3. CCool starts at 90 days, Cold starts at 180 days, and Archive starts at 365 days
    4. DCool starts at 30 days, Cold starts at 90 days, and Archive starts at 180 days
    Show the answer

    Each cooler tier commits data for a longer period before an early deletion charge applies, and the Hot tier carries no minimum duration at all. Reading the ladder as 30, 90, and 180 days keeps Cool, Cold, and Archive apart.

    Next → 17 / 25

  19. Q18 / 25

    You must inspect the combined NSG rules applied directly to a network interface and through its subnet. Which tool provides that aggregate view?

    1. ANSG diagnostics
    2. BEffective security rules
    3. CTraffic analytics
    4. DIP flow verify
    Show the answer

    Effective security rules displays all rules from the interface and subnet together; the diagnostic tools test traffic, while Traffic analytics visualizes logged flows.

    Next → 18 / 25

  20. Q19 / 25

    Which capability distinguishes a Microsoft 365 group from a security group in the captured material?

    1. AIt requires a Microsoft Entra administrator for every group operation.
    2. BIt supports Dynamic Device membership based on device attributes.
    3. CIt can contain devices and service principals for resource access.
    4. DIt provides a shared mailbox, calendar, files, and a SharePoint site.
    Show the answer

    Microsoft 365 groups are collaboration workspaces; security groups are the documented choice for access boundaries and device or service-principal membership.

    Next → 19 / 25

  21. Q20 / 25

    Which pairing correctly distinguishes a one-time connectivity test from ongoing end-to-end monitoring?

    1. AConnection monitor for one time; Packet capture for ongoing monitoring
    2. BPacket capture for one time; VPN troubleshoot for ongoing monitoring
    3. CConnection troubleshoot for one time; Connection monitor for ongoing monitoring
    4. DNext hop for one time; IP flow verify for ongoing monitoring
    Show the answer

    Connection troubleshoot tests the path at a point in time, while Connection monitor repeatedly observes connectivity and performance between endpoints.

    Next → 20 / 25

  22. Q21 / 25

    Which statement correctly describes the relationship between Bicep and ARM templates?

    1. ABicep is an imperative script that bypasses Azure Resource Manager.
    2. BBicep wraps remote ARM templates but cannot compile into an ARM template.
    3. CBicep compiles to ARM templates and retains the same ARM capabilities.
    4. DBicep can interpret ARM JSON but cannot define new Azure resources.
    Show the answer

    Bicep changes the authoring syntax, not the underlying Azure Resource Manager capability; its cleaner source is compiled to an ARM template.

    Next → 21 / 25

  23. Q22 / 25

    Which Azure Files shares support the documented identity-based authentication?

    1. ANFS file shares
    2. BSMB file shares
    3. COnly anonymous public file shares
    4. DSMB and NFS file shares equally
    Show the answer

    Azure Files uses identity sources and Kerberos for SMB access; NFS identity-based authentication is not supported by this feature.

    Next → 22 / 25

  24. Q23 / 25

    An organization must protect Azure VMs and Azure Files shares as well as Azure managed disks and Azure Blobs. It wants each datasource assigned to a supported vault type without mixing incompatible workloads. Which design is correct?

    1. AUse a Recovery Services vault for the VMs and file shares, and a Backup vault for the disks and blobs
    2. BUse a Backup vault for the VMs and blobs, and a Recovery Services vault for the disks and file shares
    3. CUse a Recovery Services vault for the VMs and disks, and a Backup vault for the file shares and blobs
    4. DUse a Backup vault for the VMs and file shares, and a Recovery Services vault for the disks and blobs
    Show the answer

    Vault selection follows datasource support: Azure VMs and Azure Files use Recovery Services vaults, while Azure Disks and Azure Blobs use Backup vaults.

    Next → 23 / 25

  25. Q24 / 25

    Finance needs to filter billing data by cost center across several resource groups, and each resource must carry its own classification. Which approach meets both constraints?

    1. AApply the CostCenter tag to each resource group and rely on inheritance to its resources
    2. BMove every resource into one group
    3. CCreate one Delete lock named CostCenter at subscription scope and export lock data
    4. DApply the CostCenter tag directly or in bulk to each supported resource
    Show the answer

    Direct or bulk resource tagging supplies the cross-group billing dimension without relying on nonexistent inheritance.

    Next → 24 / 25

  26. Q25 / 25

    Which Network Watcher tool reports whether a packet is allowed or denied and identifies the responsible security rule?

    1. APacket capture
    2. BConnection monitor
    3. CIP flow verify
    4. DNext hop
    Show the answer

    IP flow verify evaluates packet parameters at a virtual machine and ties the allow-or-deny result to a security rule.

    Next → 25 / 25

  27. That’s the whole mock exam

    Every question you miss comes back exactly when you’re about to forget it.

    Back to the course Get the app

How to use this mock exam

Sit all 25 questions in one go: the mix covers every domain in the same proportion as the exam, so a low score points at the domain you skipped rather than at bad luck.

Read the explanation under every question, including the ones you got right — the reason an option is wrong is usually the thing being tested.

Then retake it in the app, where the mock exam is timed and scored and the questions you miss come back on a schedule.

Keep your progress · Get the app

The whole course, on your phone

Lessons you can read, audio you can listen to on the way to work, and practice that remembers what you got wrong.

Get the app