AZ-104 MICROSOFT AZURE ADMINISTRATOR RENEWAL EXAM
Comprehensive Practice – 2026/2027 Edition
Aligned with the Microsoft Azure Administrator (AZ-104) Renewal Assessment Objectives & Current Azure Best Practices
150 Questions | 6 Content Domains | Multiple Choice (A–D)
Contents
Section 1: Identity & Governance – Entra ID, RBAC, Subscriptions, Azure Policy, Resource Locks (30 questions)
Section 2: Storage – Storage Accounts, Blob, Azure Files, Security, Replication, Lifecycle (25 questions)
Section 3: Compute – VMs, VMSS, App Service, Containers, AKS, Serverless (25 questions)
Section 4: Networking – VNets, NSGs, Firewall, Load Balancer, VPN, ExpressRoute, DNS (25 questions)
Section 5: Monitoring & Maintenance – Azure Monitor, Log Analytics, Backup, Site Recovery, Cost (20 questions)
Section 6: Integrated Scenario-Based Questions – Complex Azure Administration Scenarios (25 questions)
How to use this exam: Work through each section sequentially. One answer choice per question is correct; the correct answer
and a rationale follow each question. Use the rationales to reinforce Azure administration concepts. A reference answer key is
provided on the final page.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 1
, Section 1: Identity & Governance – Entra ID, RBAC, Subscriptions, Azure
Section 1
Policy, Resource Locks (30 questions)
Q1: Microsoft renamed Azure Active Directory (Azure AD) to which service name?
A. Microsoft Entra ID [CORRECT]
B. Azure Identity Manager
C. Microsoft 365 Identity
D. Active Directory Federation Services
Correct Answer: A
Rationale: Azure AD was renamed Microsoft Entra ID to reflect its broader identity and access management portfolio.
The underlying capabilities are unchanged.
Q2: Which Azure RBAC built-in role grants full management of resources, including the ability to grant
access to other users?
A. Owner [CORRECT]
B. Contributor
C. Reader
D. User Access Administrator
Correct Answer: A
Rationale: Owner has full rights, including managing access. Contributor can manage resources but not grant access,
and Reader is read-only.
Q3: A developer must create and manage virtual machines but must NOT be able to grant others access to
resources. Which RBAC role should be assigned?
A. Owner
B. Contributor [CORRECT]
C. User Access Administrator
D. Global Administrator
Correct Answer: B
Rationale: Contributor allows full resource management without the ability to assign access, which requires Owner or
User Access Administrator rights.
Q4: Which RBAC role should be assigned to an auditor who needs to view resources but make no
changes?
A. Reader [CORRECT]
B. Contributor
C. Owner
D. Virtual Machine Contributor
Correct Answer: A
Rationale: Reader grants view-only access to resources in the assigned scope without any modification rights.
Q5: You need to deny a group of users the ability to modify resources in a resource group while allowing
all other actions. Which approach is BEST?
A. Assign a custom role that excludes the prohibited actions using NotActions [CORRECT]
B. Assign Owner role and rely on auditing
C. Assign Reader role only
D. Use a resource lock only
Correct Answer: A
Rationale: A custom role with NotActions excludes specific management operations while granting all other permitted
actions, implementing least privilege precisely.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 2
, Q6: Which list shows the RBAC scope hierarchy in the correct order from broadest to narrowest?
A. Management group > Subscription > Resource group > Resource [CORRECT]
B. Resource > Resource group > Subscription > Management group
C. Subscription > Management group > Resource group > Resource
D. Resource group > Subscription > Management group > Resource
Correct Answer: A
Rationale: RBAC scopes nest from management group down to subscription, resource group, and resource;
assignments at a higher scope are inherited by lower scopes.
Q7: You apply a CanNotDelete lock to a resource group. What is the effect?
A. Authorized users can read and modify resources but cannot delete them [CORRECT]
B. Authorized users can delete but not modify resources
C. All access is denied to every user including owners
D. Only new resources are affected
Correct Answer: A
Rationale: CanNotDelete allows reads and writes but prevents deletion. A ReadOnly lock would also block modifications.
Q8: A ReadOnly resource lock is applied to a virtual network. Which statement is correct?
A. Even owners cannot modify the VNet until the lock is removed [CORRECT]
B. Owners can still modify the VNet
C. Contributors can modify the VNet
D. The lock affects only deleting, not editing
Correct Answer: A
Rationale: Resource locks override RBAC permissions; a ReadOnly lock prevents modification by all users, including
owners, until the lock is removed.
Q9: A subscription has a ReadOnly lock. To delete a storage account in that subscription, what must you
do FIRST?
A. Remove the ReadOnly lock [CORRECT]
B. Assign Owner role
C. Use the Azure portal only
D. Delete the subscription
Correct Answer: A
Rationale: Locks are inherited by child resources, so the lock must be removed before any modification or deletion can
occur.
Q10: You must prevent the creation of any virtual machine outside the West Europe region. Which Azure
Policy effect is MOST appropriate?
A. Deny [CORRECT]
B. Audit
C. AuditIfNotExists
D. Append
Correct Answer: A
Rationale: Deny blocks non-compliant deployments. Audit only reports them, and Append adds fields rather than
blocking.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 3
, Q11: Management wants visibility into which resources are non-compliant without blocking deployments.
Which policy effect should you use?
A. Audit [CORRECT]
B. Deny
C. DeployIfNotExists
D. Modify
Correct Answer: A
Rationale: Audit evaluates and reports compliance without preventing resource creation, which is appropriate for
visibility-first rollouts.
Q12: A group of related Azure Policy definitions that are assigned together to enforce multiple
requirements is called a(n):
A. Initiative [CORRECT]
B. Blueprint
C. Lock
D. Action group
Correct Answer: A
Rationale: A policy initiative is a collection of policy definitions bundled and assigned together to manage compliance
across many rules.
Q13: Your company has many subscriptions. Which feature should you use to apply policies and
governance consistently across all of them?
A. Management groups [CORRECT]
B. Resource locks
C. Availability sets
D. Log Analytics workspaces
Correct Answer: A
Rationale: Management groups organize subscriptions into a hierarchy so policies, RBAC, and budgets can be applied
consistently across the estate.
Q14: You must require multifactor authentication (MFA) for all administrators signing in from outside the
corporate network. Which feature should you configure?
A. A Conditional Access policy [CORRECT]
B. A resource lock
C. A network security group rule
D. A storage access policy
Correct Answer: A
Rationale: Conditional Access policies enforce access requirements (such as MFA) based on conditions like location,
device, and risk.
Q15: Which Microsoft Entra ID feature automatically adds or removes users from a group based on
attributes such as department or job title?
A. Dynamic group membership [CORRECT]
B. Privileged Identity Management
C. Access reviews
D. Managed identities
Correct Answer: A
Rationale: Dynamic groups use membership rules evaluated against user attributes to automatically manage group
membership.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 4
Comprehensive Practice – 2026/2027 Edition
Aligned with the Microsoft Azure Administrator (AZ-104) Renewal Assessment Objectives & Current Azure Best Practices
150 Questions | 6 Content Domains | Multiple Choice (A–D)
Contents
Section 1: Identity & Governance – Entra ID, RBAC, Subscriptions, Azure Policy, Resource Locks (30 questions)
Section 2: Storage – Storage Accounts, Blob, Azure Files, Security, Replication, Lifecycle (25 questions)
Section 3: Compute – VMs, VMSS, App Service, Containers, AKS, Serverless (25 questions)
Section 4: Networking – VNets, NSGs, Firewall, Load Balancer, VPN, ExpressRoute, DNS (25 questions)
Section 5: Monitoring & Maintenance – Azure Monitor, Log Analytics, Backup, Site Recovery, Cost (20 questions)
Section 6: Integrated Scenario-Based Questions – Complex Azure Administration Scenarios (25 questions)
How to use this exam: Work through each section sequentially. One answer choice per question is correct; the correct answer
and a rationale follow each question. Use the rationales to reinforce Azure administration concepts. A reference answer key is
provided on the final page.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 1
, Section 1: Identity & Governance – Entra ID, RBAC, Subscriptions, Azure
Section 1
Policy, Resource Locks (30 questions)
Q1: Microsoft renamed Azure Active Directory (Azure AD) to which service name?
A. Microsoft Entra ID [CORRECT]
B. Azure Identity Manager
C. Microsoft 365 Identity
D. Active Directory Federation Services
Correct Answer: A
Rationale: Azure AD was renamed Microsoft Entra ID to reflect its broader identity and access management portfolio.
The underlying capabilities are unchanged.
Q2: Which Azure RBAC built-in role grants full management of resources, including the ability to grant
access to other users?
A. Owner [CORRECT]
B. Contributor
C. Reader
D. User Access Administrator
Correct Answer: A
Rationale: Owner has full rights, including managing access. Contributor can manage resources but not grant access,
and Reader is read-only.
Q3: A developer must create and manage virtual machines but must NOT be able to grant others access to
resources. Which RBAC role should be assigned?
A. Owner
B. Contributor [CORRECT]
C. User Access Administrator
D. Global Administrator
Correct Answer: B
Rationale: Contributor allows full resource management without the ability to assign access, which requires Owner or
User Access Administrator rights.
Q4: Which RBAC role should be assigned to an auditor who needs to view resources but make no
changes?
A. Reader [CORRECT]
B. Contributor
C. Owner
D. Virtual Machine Contributor
Correct Answer: A
Rationale: Reader grants view-only access to resources in the assigned scope without any modification rights.
Q5: You need to deny a group of users the ability to modify resources in a resource group while allowing
all other actions. Which approach is BEST?
A. Assign a custom role that excludes the prohibited actions using NotActions [CORRECT]
B. Assign Owner role and rely on auditing
C. Assign Reader role only
D. Use a resource lock only
Correct Answer: A
Rationale: A custom role with NotActions excludes specific management operations while granting all other permitted
actions, implementing least privilege precisely.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 2
, Q6: Which list shows the RBAC scope hierarchy in the correct order from broadest to narrowest?
A. Management group > Subscription > Resource group > Resource [CORRECT]
B. Resource > Resource group > Subscription > Management group
C. Subscription > Management group > Resource group > Resource
D. Resource group > Subscription > Management group > Resource
Correct Answer: A
Rationale: RBAC scopes nest from management group down to subscription, resource group, and resource;
assignments at a higher scope are inherited by lower scopes.
Q7: You apply a CanNotDelete lock to a resource group. What is the effect?
A. Authorized users can read and modify resources but cannot delete them [CORRECT]
B. Authorized users can delete but not modify resources
C. All access is denied to every user including owners
D. Only new resources are affected
Correct Answer: A
Rationale: CanNotDelete allows reads and writes but prevents deletion. A ReadOnly lock would also block modifications.
Q8: A ReadOnly resource lock is applied to a virtual network. Which statement is correct?
A. Even owners cannot modify the VNet until the lock is removed [CORRECT]
B. Owners can still modify the VNet
C. Contributors can modify the VNet
D. The lock affects only deleting, not editing
Correct Answer: A
Rationale: Resource locks override RBAC permissions; a ReadOnly lock prevents modification by all users, including
owners, until the lock is removed.
Q9: A subscription has a ReadOnly lock. To delete a storage account in that subscription, what must you
do FIRST?
A. Remove the ReadOnly lock [CORRECT]
B. Assign Owner role
C. Use the Azure portal only
D. Delete the subscription
Correct Answer: A
Rationale: Locks are inherited by child resources, so the lock must be removed before any modification or deletion can
occur.
Q10: You must prevent the creation of any virtual machine outside the West Europe region. Which Azure
Policy effect is MOST appropriate?
A. Deny [CORRECT]
B. Audit
C. AuditIfNotExists
D. Append
Correct Answer: A
Rationale: Deny blocks non-compliant deployments. Audit only reports them, and Append adds fields rather than
blocking.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 3
, Q11: Management wants visibility into which resources are non-compliant without blocking deployments.
Which policy effect should you use?
A. Audit [CORRECT]
B. Deny
C. DeployIfNotExists
D. Modify
Correct Answer: A
Rationale: Audit evaluates and reports compliance without preventing resource creation, which is appropriate for
visibility-first rollouts.
Q12: A group of related Azure Policy definitions that are assigned together to enforce multiple
requirements is called a(n):
A. Initiative [CORRECT]
B. Blueprint
C. Lock
D. Action group
Correct Answer: A
Rationale: A policy initiative is a collection of policy definitions bundled and assigned together to manage compliance
across many rules.
Q13: Your company has many subscriptions. Which feature should you use to apply policies and
governance consistently across all of them?
A. Management groups [CORRECT]
B. Resource locks
C. Availability sets
D. Log Analytics workspaces
Correct Answer: A
Rationale: Management groups organize subscriptions into a hierarchy so policies, RBAC, and budgets can be applied
consistently across the estate.
Q14: You must require multifactor authentication (MFA) for all administrators signing in from outside the
corporate network. Which feature should you configure?
A. A Conditional Access policy [CORRECT]
B. A resource lock
C. A network security group rule
D. A storage access policy
Correct Answer: A
Rationale: Conditional Access policies enforce access requirements (such as MFA) based on conditions like location,
device, and risk.
Q15: Which Microsoft Entra ID feature automatically adds or removes users from a group based on
attributes such as department or job title?
A. Dynamic group membership [CORRECT]
B. Privileged Identity Management
C. Access reviews
D. Managed identities
Correct Answer: A
Rationale: Dynamic groups use membership rules evaluated against user attributes to automatically manage group
membership.
AZ-104 Microsoft Azure Administrator Renewal Exam – Comprehensive Practice (2026/2027 Edition) Page 4
