Microsoft Azure Administrator (AZ-104) Practice Formatted: Font: 24 pt
Formatted: Centered
Exam Formatted: Top: (Shadowed Single solid line, Auto,
2.25 pt Line width), Bottom: (Shadowed Single solid
line, Auto, 2.25 pt Line width), Left: (Shadowed Single
Comprehensive Practice Examination (150 solid line, Auto, 2.25 pt Line width), Right: (Shadowed
Single solid line, Auto, 2.25 pt Line width)
Questions)
Formatted: Font: 12 pt
Domain 1: Manage Azure Identities and Governance (Questions 1-30) Formatted: Font: 12 pt
Question 1: Which Azure service is used to manage user identities and access to resources?
A) Azure Active Directory
B) Azure Policy
C) Azure Role-Based Access Control (RBAC)
D) Azure Key Vault
Answer: A) Azure Active Directory
Rationale: Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management
service. It provides authentication and authorization for users, applications, and devices. Azure AD handles
user identities, group management, single sign-on (SSO), and multi-factor authentication (MFA). RBAC and
Azure Policy are used for authorization and compliance, while Key Vault is used for secrets management.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 2: What is the purpose of Azure Role-Based Access Control (RBAC)?
A) To manage user identities and authentication
B) To control access to Azure resources based on roles
C) To manage virtual machines
D) To monitor Azure resources
Answer: B) To control access to Azure resources based on roles
Rationale: Azure RBAC is a system that provides fine-grained access management for Azure resources. It
allows you to grant users, groups, or service principals access to specific resources or resource groups by
assigning them roles. Roles define the permissions a user has (e.g., Reader, Contributor, Owner). RBAC is
built on Azure Resource Manager (ARM).
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 3: Which of the following is a built-in Azure RBAC role?
A) Virtual Machine Administrator
B) Reader
C) Network Administrator
D) Storage Account Manager
,Answer: B) Reader
Rationale: Azure provides several built-in RBAC roles, including: Reader (read-only access to resources),
Contributor (read/write access, but cannot assign roles to others), Owner (full access, including role
assignment), and User Access Administrator (can manage user access). While there are VM-specific roles,
Reader is a fundamental built-in role.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 4: What is the purpose of Azure Policy?
A) To enforce organizational standards and compliance at scale
B) To manage user identities
C) To deploy virtual machines
D) To monitor network traffic
Answer: A) To enforce organizational standards and compliance at scale
Rationale: Azure Policy is a service that helps enforce organizational standards and ensure compliance
across resources. It evaluates resources against defined policies (e.g., allowed locations, allowed VM
sizes, tag requirements) and can take actions like auditing, denying, or deploying configurations. Azure
Policy works at the management group, subscription, or resource group level.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 5: Which of the following is a component of Azure Policy?
A) Policy definition
B) Initiative
C) Assignment
D) All of the above
Answer: D) All of the above
Rationale: Azure Policy components include: (1) Policy definitions - individual rules that specify conditions
and effects (e.g., audit, deny, modify, deploy); (2) Initiatives - groups of related policy definitions (e.g., a
security initiative); (3) Assignments - applying policies or initiatives to a specific scope (management group,
subscription, or resource group).
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 6: What is an Azure Management Group?
A) A container for managing subscriptions and governance
B) A group of users for RBAC
C) A group of virtual machines
D) A group of resource groups
Answer: A) A container for managing subscriptions and governance
Rationale: Azure Management Groups are containers that allow you to manage access, policy, and
compliance across multiple Azure subscriptions. They provide a hierarchy above the subscription level,
,enabling you to apply policies, RBAC assignments, and governance controls to all subscriptions in the
group.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 7: Which of the following is true about Azure AD Groups?
A) They can contain users, devices, and other groups (security groups)
B) They are used to assign permissions to resources
C) They can be nested
D) All of the above
Answer: D) All of the above
Rationale: Azure AD Groups are containers for users, devices, and other groups. They are used to assign
permissions to resources (via RBAC). Groups can be nested (a group can contain another group). There
are two types: security groups (for access control) and Microsoft 365 groups (for collaboration, with a
SharePoint site, Outlook mailbox, etc.).
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 8: What is the purpose of Azure Multi-Factor Authentication (MFA)?
A) To require users to provide two or more authentication factors
B) To assign IP addresses
C) To monitor network traffic
D) To deploy virtual machines
Answer: A) To require users to provide two or more authentication factors
Rationale: Azure MFA is a security feature that requires users to provide multiple authentication factors to
verify their identity. Factors include: (1) Something you know (password), (2) Something you have (phone,
hardware token), and (3) Something you are (biometrics). MFA significantly reduces the risk of
unauthorized access due to compromised passwords.
Formatted: Font: 12 pt
Question 9: What is Azure AD Privileged Identity Management (PIM)? Formatted: Font: 12 pt
A) A service that manages time-based and approval-based role activation
B) A service for identity management
C) A service for virtual machine management
D) A service for resource monitoring
Answer: A) A service that manages time-based and approval-based role activation
Rationale: Azure AD Privileged Identity Management (PIM) is a service that enables you to manage,
control, and monitor access to important resources. It provides just-in-time (JIT) privileged access, requiring
users to request and be approved for elevated roles. PIM also provides alerts and audit history for
privileged activities.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
, Question 10: What is the purpose of Azure AD Conditional Access?
A) To control access to resources based on conditions (e.g., location, device compliance)
B) To assign IP addresses
C) To deploy virtual machines
D) To monitor network traffic
Answer: A) To control access to resources based on conditions (e.g., location, device compliance)
Rationale: Azure AD Conditional Access is a policy engine that controls access to cloud apps based on
signals and conditions. Conditions can include user or group membership, IP location, device state
(compliant or not), risk level, and sign-in risk. If conditions are met, access can be granted, blocked, or
require MFA.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 11: What is an Azure subscription?
A) A billing and management boundary for Azure resources
B) A group of Azure resources
C) A virtual network
D) A region
Answer: A) A billing and management boundary for Azure resources
Rationale: An Azure subscription is a logical container that provides billing, access control, and
management boundaries for Azure resources. It is the primary unit of billing and is tied to a specific account
(e.g., Enterprise Agreement, Pay-as-you-go). Multiple subscriptions can be grouped under management
groups for governance.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 12: Which of the following can be used to manage Azure resources via the command line?
A) Azure Portal
B) Azure CLI
C) Azure PowerShell
D) Both B and C
Answer: D) Both B and C
Rationale: Azure can be managed through: (1) Azure Portal - a web-based GUI; (2) Azure CLI - a cross-
platform command-line tool; (3) Azure PowerShell - a set of PowerShell modules; (4) ARM templates -
infrastructure as code; and (5) REST APIs. Azure CLI and Azure PowerShell are the primary command-line
tools.
Formatted: Font: 12 pt
Question 13: What is the purpose of an Azure Resource Group? Formatted: Font: 12 pt
A) To group resources for management, billing, and lifecycle
B) To group users for RBAC
Formatted: Centered
Exam Formatted: Top: (Shadowed Single solid line, Auto,
2.25 pt Line width), Bottom: (Shadowed Single solid
line, Auto, 2.25 pt Line width), Left: (Shadowed Single
Comprehensive Practice Examination (150 solid line, Auto, 2.25 pt Line width), Right: (Shadowed
Single solid line, Auto, 2.25 pt Line width)
Questions)
Formatted: Font: 12 pt
Domain 1: Manage Azure Identities and Governance (Questions 1-30) Formatted: Font: 12 pt
Question 1: Which Azure service is used to manage user identities and access to resources?
A) Azure Active Directory
B) Azure Policy
C) Azure Role-Based Access Control (RBAC)
D) Azure Key Vault
Answer: A) Azure Active Directory
Rationale: Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management
service. It provides authentication and authorization for users, applications, and devices. Azure AD handles
user identities, group management, single sign-on (SSO), and multi-factor authentication (MFA). RBAC and
Azure Policy are used for authorization and compliance, while Key Vault is used for secrets management.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 2: What is the purpose of Azure Role-Based Access Control (RBAC)?
A) To manage user identities and authentication
B) To control access to Azure resources based on roles
C) To manage virtual machines
D) To monitor Azure resources
Answer: B) To control access to Azure resources based on roles
Rationale: Azure RBAC is a system that provides fine-grained access management for Azure resources. It
allows you to grant users, groups, or service principals access to specific resources or resource groups by
assigning them roles. Roles define the permissions a user has (e.g., Reader, Contributor, Owner). RBAC is
built on Azure Resource Manager (ARM).
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 3: Which of the following is a built-in Azure RBAC role?
A) Virtual Machine Administrator
B) Reader
C) Network Administrator
D) Storage Account Manager
,Answer: B) Reader
Rationale: Azure provides several built-in RBAC roles, including: Reader (read-only access to resources),
Contributor (read/write access, but cannot assign roles to others), Owner (full access, including role
assignment), and User Access Administrator (can manage user access). While there are VM-specific roles,
Reader is a fundamental built-in role.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 4: What is the purpose of Azure Policy?
A) To enforce organizational standards and compliance at scale
B) To manage user identities
C) To deploy virtual machines
D) To monitor network traffic
Answer: A) To enforce organizational standards and compliance at scale
Rationale: Azure Policy is a service that helps enforce organizational standards and ensure compliance
across resources. It evaluates resources against defined policies (e.g., allowed locations, allowed VM
sizes, tag requirements) and can take actions like auditing, denying, or deploying configurations. Azure
Policy works at the management group, subscription, or resource group level.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 5: Which of the following is a component of Azure Policy?
A) Policy definition
B) Initiative
C) Assignment
D) All of the above
Answer: D) All of the above
Rationale: Azure Policy components include: (1) Policy definitions - individual rules that specify conditions
and effects (e.g., audit, deny, modify, deploy); (2) Initiatives - groups of related policy definitions (e.g., a
security initiative); (3) Assignments - applying policies or initiatives to a specific scope (management group,
subscription, or resource group).
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 6: What is an Azure Management Group?
A) A container for managing subscriptions and governance
B) A group of users for RBAC
C) A group of virtual machines
D) A group of resource groups
Answer: A) A container for managing subscriptions and governance
Rationale: Azure Management Groups are containers that allow you to manage access, policy, and
compliance across multiple Azure subscriptions. They provide a hierarchy above the subscription level,
,enabling you to apply policies, RBAC assignments, and governance controls to all subscriptions in the
group.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 7: Which of the following is true about Azure AD Groups?
A) They can contain users, devices, and other groups (security groups)
B) They are used to assign permissions to resources
C) They can be nested
D) All of the above
Answer: D) All of the above
Rationale: Azure AD Groups are containers for users, devices, and other groups. They are used to assign
permissions to resources (via RBAC). Groups can be nested (a group can contain another group). There
are two types: security groups (for access control) and Microsoft 365 groups (for collaboration, with a
SharePoint site, Outlook mailbox, etc.).
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 8: What is the purpose of Azure Multi-Factor Authentication (MFA)?
A) To require users to provide two or more authentication factors
B) To assign IP addresses
C) To monitor network traffic
D) To deploy virtual machines
Answer: A) To require users to provide two or more authentication factors
Rationale: Azure MFA is a security feature that requires users to provide multiple authentication factors to
verify their identity. Factors include: (1) Something you know (password), (2) Something you have (phone,
hardware token), and (3) Something you are (biometrics). MFA significantly reduces the risk of
unauthorized access due to compromised passwords.
Formatted: Font: 12 pt
Question 9: What is Azure AD Privileged Identity Management (PIM)? Formatted: Font: 12 pt
A) A service that manages time-based and approval-based role activation
B) A service for identity management
C) A service for virtual machine management
D) A service for resource monitoring
Answer: A) A service that manages time-based and approval-based role activation
Rationale: Azure AD Privileged Identity Management (PIM) is a service that enables you to manage,
control, and monitor access to important resources. It provides just-in-time (JIT) privileged access, requiring
users to request and be approved for elevated roles. PIM also provides alerts and audit history for
privileged activities.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
, Question 10: What is the purpose of Azure AD Conditional Access?
A) To control access to resources based on conditions (e.g., location, device compliance)
B) To assign IP addresses
C) To deploy virtual machines
D) To monitor network traffic
Answer: A) To control access to resources based on conditions (e.g., location, device compliance)
Rationale: Azure AD Conditional Access is a policy engine that controls access to cloud apps based on
signals and conditions. Conditions can include user or group membership, IP location, device state
(compliant or not), risk level, and sign-in risk. If conditions are met, access can be granted, blocked, or
require MFA.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 11: What is an Azure subscription?
A) A billing and management boundary for Azure resources
B) A group of Azure resources
C) A virtual network
D) A region
Answer: A) A billing and management boundary for Azure resources
Rationale: An Azure subscription is a logical container that provides billing, access control, and
management boundaries for Azure resources. It is the primary unit of billing and is tied to a specific account
(e.g., Enterprise Agreement, Pay-as-you-go). Multiple subscriptions can be grouped under management
groups for governance.
Formatted: Font: 12 pt
Formatted: Font: 12 pt
Question 12: Which of the following can be used to manage Azure resources via the command line?
A) Azure Portal
B) Azure CLI
C) Azure PowerShell
D) Both B and C
Answer: D) Both B and C
Rationale: Azure can be managed through: (1) Azure Portal - a web-based GUI; (2) Azure CLI - a cross-
platform command-line tool; (3) Azure PowerShell - a set of PowerShell modules; (4) ARM templates -
infrastructure as code; and (5) REST APIs. Azure CLI and Azure PowerShell are the primary command-line
tools.
Formatted: Font: 12 pt
Question 13: What is the purpose of an Azure Resource Group? Formatted: Font: 12 pt
A) To group resources for management, billing, and lifecycle
B) To group users for RBAC
