Microsoft Azure Administrator Exam Prep

Deleting an Azure storage account and overwriting a blob are different operations, so protection against one does not automatically protect against the other. Azure administration depends on matching access, governance and recovery settings to the resource and failure being addressed.

Microsoft’s AZ-104 exam is associated with the Azure Administrator Associate certification. It covers implementing, managing and monitoring Azure environments, including identity and governance, storage, compute, networking and ongoing maintenance. Candidates are expected to understand operating systems and networking and have experience with the Azure portal, PowerShell, the Azure command-line interface (CLI), infrastructure templates and Microsoft Entra ID.

Resource

A managed Azure object, such as a virtual machine (VM), virtual network or storage account. Resource groups organize resources for management.

Scope

The resources to which an access assignment or governance rule applies. Azure scopes include management groups, subscriptions, resource groups and individual resources. A broader scope can affect many descendants.

Control plane and data plane

The control plane manages Azure resources. The data plane uses the service they provide, such as reading or overwriting a blob. Protecting a storage account’s management operations does not automatically protect every operation on its contents.

For access control, a role determines the permitted actions and its assignment scope determines where those permissions apply. An operator who needs to manage one VM may not need access to its entire resource group or subscription. Choosing an unnecessarily broad scope exposes other resources to the same permissions. Governance requirements, such as permitted deployment locations, must also be considered rather than assuming that an authorized user can deploy any configuration.

Storage protection involves a different distinction. Availability concerns keeping data accessible during failures, while recovery concerns returning to a usable earlier state. Copies spread across availability zones protect against different failures from copies kept in a single physical location. Replication to another region adds geographic protection, but asynchronous replication can leave the secondary copy behind the latest writes. None of those choices, by itself, provides a history of overwritten data.

Blob versioning addresses that history by retaining earlier versions on supported accounts. Retaining versions can increase storage costs, and retention or lifecycle rules influence how long earlier data remains available. A sound storage decision therefore starts with the failure to be handled, such as a hardware outage, an accidental overwrite or deletion of the account itself, rather than treating every protection feature as interchangeable.

Deployment and monitoring need similar care. Previewing a proposed change is different from applying it successfully. Configuring a log query is different from collecting the records it needs. Understanding these dependencies makes it easier to explain why a plausible answer does not satisfy all the conditions in an administration scenario.

The certification exam is proctored, allows 100 minutes for the assessment and may include interactive components. Single-answer questions can help identify gaps in knowledge, but they do not demonstrate that a deployment, access change or restore has been carried out correctly. Preparation should combine scenario reasoning with documented procedures and hands-on work in an isolated Azure environment.

How to Use This Tool:

Use this unofficial, untimed practice for focused study or a mixed round. The bank contains 30 independently authored English questions, six per domain, with one answer to choose from four options.

1. Choose a Domain and Question count. All five domains · unweighted offers 5, 10, 15 or 30 questions and starts at 10. A single domain offers 3 or 6 questions, with 6 as its default.
2. Select Feedback. After each answer shows the correction and explanation before you continue. At the end of the round records each answer without revealing correctness until the results.
3. Set Replay seed under Advanced when you need a repeatable round. A blank or space-only entry uses az104-practice; surrounding spaces are ignored. Keep the domain, count, feedback mode and seed unchanged to reproduce the questions and option order while the bank remains unchanged.
   The seed allows up to 128 UTF-16 units; some Unicode characters use two units. Longer entries are shortened without splitting a character. Check the shortening notice. Clear the field or replace the text with a shorter valid seed if a seed warning prevents starting.
4. Answer the questions after selecting Start exam practice. Choosing an option immediately records and locks it; there is no separate submission step or answer-editing step. Select Next unanswered question to continue, then View results after the last answer.
   End round discards the current attempt and returns to setup. It does not produce a completed review of a partly answered round.
5. Review Missed answer review and the full Answer ledger. Use Retry missed for a new round containing only incorrect answers, or Practise domain to start focused practice. Replay same seed repeats the current round’s questions and option order; Try a new seed changes the seed for another selection or ordering.

Interpreting Results:

The final fraction is the number of correct answers out of all questions in that round. During an attempt, the progress percentage measures how many questions have been answered, not how many were correct. Despite the heading Readiness review, the result is a review of these authored questions, not an estimate of your probability of passing AZ-104.

Domain performance shows correct and missed counts for sampled domains. A longer bar may simply mean that more questions came from that domain. Not sampled in this round means untested, not a zero score. When the chart is unavailable, use Retry chart; the written domain counts and answer ledger remain available for review.

Check the explanations for successful guesses as well as mistakes. Repeating familiar questions can improve the score without demonstrating that you can perform the corresponding Azure task. A different seed can still repeat questions from this limited bank, so extend your study using the full objectives and practical exercises.

Microsoft reports technical exam results on a scale of 1 to 1,000, with 700 or greater required to pass. That is a scaled score, not a rule that 70% correct passes. There is no supported conversion from this practice fraction to Microsoft’s score. Microsoft does not endorse this tool, and completing its rounds does not award a certification or establish professional competence.

Technical Details:

A single-answer practice score counts matches to the designated answer for each scenario. Every question in the selected round has the same value. Neither the official domain weights nor an estimate of question difficulty changes its contribution.

Counting correct answers and completed questions

Let C be the correct-answer count, A the answered count and N the positive total number of questions in the current round. Each correct answer earns one point; an incorrect answer earns zero, with no deduction or partial credit. The score, its percentage equivalent and completion progress are calculated separately.

Possible points equal N, so the score ranges from zero to N. Unanswered questions remain in that denominator but are not counted as incorrect. The missed count is the answered count minus the correct count. The final headline displays the exact count fraction rather than a rounded percentage; raw accuracy and underlying progress are unrounded. Visible progress text rounds to the nearest whole percent, with half-percent ties upward; the bar width and accessible progress value retain the raw percentage.

A completed review requires every question to have an answer. Its two review messages distinguish a round with misses from a round without them; they are not calibrated readiness bands.

Question selection and objective coverage

Selection is seeded and uniform without replacement within the chosen pool. A question cannot occur twice in one round, but it can reappear in later rounds. Each question retains its three authored incorrect alternatives while the option order is shuffled. Changing the feedback mode can also change the selected questions even when the seed stays the same.

The target is the English Skills measured as of April 17, 2026 objective edition. Question references carry a September 11, 2026 verification date. The skills-measured date names an objective edition, not an exam launch date or exact live question composition. Those dates identify the intended scope and recorded reference check; they do not guarantee that later Azure changes are reflected or that another exam language follows the same update schedule.

A 30-question round contains all six questions from each domain, making each domain 20% of that round. Shorter mixed rounds have no fixed domain quotas. A new seed cannot introduce unseen questions into a full-bank round because all 30 are already included. Neither arrangement reproduces the official weighting, and the questions are not calibrated to official difficulty.

The domain names should not be read as complete coverage. Creating Microsoft Entra users, configuring identity-based Azure Files access, provisioning containers, troubleshooting load balancing and performing actual restores are examples of objectives requiring study beyond these questions. No hands-on task is simulated.

Access grants and restrictions

Azure role-based access control (RBAC) combines an identity, a role’s permissions and an assignment scope. Grants are additive. In the scenario with Contributor at subscription scope and Reader at a resource group, adding Reader does not withdraw the inherited Contributor grant. Reducing the broader access requires changing the broader assignment rather than adding another narrower grant.

An enforced Azure Policy deny effect serves a different purpose. When a new deployment matches an allowed-locations denial condition and has no exemption, the request is blocked rather than relocated or deployed and then removed. The assignment’s scope, parameters and exemptions determine whether that restriction applies.

Storage protection depends on the failure

Replication, version history and management locks solve different problems. The following choices apply only where the account and service support the named feature.

A new connection must pass each applicable security group

Within a network security group (NSG), lower priority numbers are processed first, and the first matching rule decides the result. For a new connection matching an allow rule at priority 200 and a deny rule at priority 300, with no earlier match, the result in that NSG is allow. A deny action does not automatically override an earlier matching allow.

When both subnet and VM network-interface NSGs apply to inbound traffic, the subnet rules are evaluated before the interface rules. Both must allow the connection. An allow in one does not override a deny in the other, and routing or the guest firewall can still prevent access. Existing connections can persist after an NSG rule changes, so a new connection is needed when checking the changed rule’s effect.

A deployment preview is not a deployment guarantee

Azure Resource Manager’s what-if operation predicts the changes proposed by a Bicep deployment without applying them. Some expressions or resource dependencies cannot be fully evaluated during that preview. A useful result therefore includes reviewing any unevaluated changes and checking the prerequisites of the actual resources, not assuming that a preview proves the deployment will succeed.

Privacy Notes:

Answers are scored in your browser, but the saved attempt is encoded in the page URL without encryption. That URL carries the information needed to reconstruct the round, including its seed and recorded choices. Anyone receiving it can restore the saved answers; it is not a private results link.

• URLs can remain in browser history and be sent to the site when the page is loaded again. Ending a round clears its saved data from the current URL, not from links already copied or other retained copies.
• Page assets, chart and document features, and opened documentation links can use the network. Browser scoring does not mean the entire experience is fully offline or makes no network requests.
• Exported answer ledgers include recorded responses. Avoid confidential information in a replay seed and share saved attempts or ledgers only with people who should see those answers.

A Saved attempt unavailable message means the saved round could not be restored, not that you scored zero. Choose current settings and start a new attempt. If a warning says the attempt cannot be saved in the URL but remains in memory, keep the page open to finish; reloading may lose that unsaved progress.

Worked Examples:

References:

• Study guide for Exam AZ-104: Microsoft Azure Administrator, Microsoft.
• Microsoft Certified: Azure Administrator Associate, Microsoft.
• Exam scoring and score reports, Microsoft.
• What is Azure role-based access control?, Microsoft.
• Azure Policy definitions deny effect, Microsoft.
• Lock your Azure resources to protect your infrastructure, Microsoft.
• Azure Storage redundancy, Microsoft.
• Blob versioning, Microsoft.
• Bicep What-If: Preview Changes Before Deployment, Microsoft.
• Azure network security groups overview, Microsoft.
• How network security groups filter network traffic, Microsoft.
• Diagnostic settings in Azure Monitor, Microsoft.
• Get started with log queries in Azure Monitor Logs, Microsoft.
• Quickstart: Back up a virtual machine in Azure, Microsoft.