WGU D338 Cloud Platform Solutions | AZ-104 Azure Administrator Comprehensive
Practice Exam – 100 Questions and Answers with Detailed Rationales | 2026/2027 Updated.
This resource is aligned with the Microsoft AZ-104 skills measured from April 17, 2026, and
tailored to the subject matter of WGU D338. It is an independently created preparation exam, not
a reproduction of WGU or Microsoft assessment questions.
Research verification
WGU's 2026 institutional catalog identifies D338 as Cloud Platform Solutions, course ITCL
3204, worth three competency units. WGU's transfer guidelines recognize the Microsoft Azure
Administrator AZ-104 certification for this course.
Western Governors University
+1
Microsoft's official AZ-104 blueprint establishes five competencies. I have distributed the 100
original questions accordingly, with added emphasis on configuration decisions, troubleshooting,
security, and practical administrative scenarios.
Microsoft Learn
Section Questions Count
1. Azure identities and governance 1–23 23
2. Azure storage administration 24–41 18
3. Azure compute and application services 42–65 24
4. Virtual networking and connectivity 66–85 20
5. Monitoring, backup, and recovery 86–100 15
Total 100
Section 1. Manage Azure identities and governance
Questions 1–23 · Entra ID, RBAC, Azure Policy, subscriptions, management groups, resource
locks, and cost governance.
Question 1. Microsoft Entra ID user management
A company hires a new employee who requires an organizational identity to access Azure-
integrated applications. Which action should the administrator perform?
A. Create a virtual machine for the employee
, B. Create a user account in Microsoft Entra ID
C. Create a new Azure subscription
D. Create an Azure Storage account
Correct Answer: B
Rationale: Microsoft Entra ID provides cloud identity and access management. Creating a user
account establishes the employee's organizational identity, which can subsequently be assigned
authentication methods, licenses, group memberships, and permissions. Neither a subscription
nor a virtual machine creates an employee identity.
Question 2. Group-based licensing
An organization wants users in its Sales department to receive the same Microsoft 365 licenses
automatically when they join a particular group. What should the administrator configure?
A. Azure Policy assignment
B. Network security group
C. Group-based licensing in Microsoft Entra ID
D. Azure resource lock
Correct Answer: C
Rationale: Group-based licensing assigns supported product licenses to group members. Eligible
users inherit the licenses when added and can have inherited licenses removed when they leave.
This reduces administrative effort and avoids manually licensing each employee.
Question 3. External collaboration
A consulting firm needs temporary access to a company's Microsoft Entra-integrated
collaboration resources using consultants' existing organizational identities. Which capability is
most appropriate?
A. Microsoft Entra B2B collaboration
B. Azure Virtual Machine Scale Sets
C. Azure Load Balancer
D. Microsoft Entra device registration only
Correct Answer: A
Rationale: Microsoft Entra B2B collaboration allows external users to be invited as guests and
access authorized organizational resources. It supports collaboration without requiring the
consultants to become ordinary internal employees.
Question 4. Dynamic group membership
,An administrator wants users whose department attribute equals Finance to be added
automatically to a group. Which configuration should be used?
A. Assigned membership group with manual updates
B. Azure resource group
C. Azure Policy exemption
D. Dynamic membership group based on a user attribute rule
Correct Answer: D
Rationale: Microsoft Entra dynamic groups evaluate user attributes against configured
membership rules. When an eligible user's department matches the Finance rule, membership is
automatically processed. Dynamic membership requires the appropriate Microsoft Entra
licensing.
Question 5. Self-service password reset
Users frequently contact the help desk to reset forgotten passwords. The company wants eligible
users to reset their passwords securely without administrator involvement.
Which feature should be enabled?
A. Azure Resource Manager
B. Microsoft Entra self-service password reset
C. Azure Monitor metrics
D. Azure Application Gateway
Correct Answer: B
Rationale: Self-service password reset (SSPR) permits authorized users to recover or reset their
passwords after satisfying configured verification requirements. Administrators can scope SSPR
to eligible users or groups and configure acceptable authentication methods.
Question 6. Read-only Azure resource access
An auditor must view resource configurations in an Azure resource group but must not modify
its resources.
Which built-in Azure role provides the appropriate access?
A. Owner
B. Contributor
C. Reader
D. User Access Administrator
Correct Answer: C
, Rationale: The Reader role provides visibility into Azure resource configuration without
permission to perform resource modifications. Contributor and Owner provide substantially
broader management permissions, making them inappropriate for this read-only requirement.
Question 7. Contributor permissions
An engineer has the Contributor role assigned at a resource group scope. Which operation is the
engineer generally unable to perform through that role alone?
A. Create a virtual machine
B. Modify a storage account
C. Delete a permitted resource
D. Assign Azure RBAC roles to other users
Correct Answer: D
Rationale: Contributor can manage resources but cannot grant Azure RBAC permissions to other
identities. Role assignment management requires authorization such as Owner, User Access
Administrator, or a suitably configured Role Based Access Control Administrator role.
Question 8. Delegating role assignment administration
An administrator must allow a security operator to manage Azure RBAC role assignments within
one resource group without granting broad permissions to modify the workloads.
Which built-in role is appropriate?
A. User Access Administrator
B. Storage Blob Data Reader
C. Virtual Machine Contributor
D. Monitoring Reader
Correct Answer: A
Rationale: User Access Administrator can manage Azure access assignments at the granted
scope. Assigning this role at the specific resource group limits its authority to that scope and its
descendants. The other roles do not provide general RBAC assignment management.
Question 9. RBAC inheritance
A user receives the Reader role at the subscription level. The subscription contains several
resource groups and virtual machines.
What access does the user inherit?
A. Reader access only to newly created resource groups
Practice Exam – 100 Questions and Answers with Detailed Rationales | 2026/2027 Updated.
This resource is aligned with the Microsoft AZ-104 skills measured from April 17, 2026, and
tailored to the subject matter of WGU D338. It is an independently created preparation exam, not
a reproduction of WGU or Microsoft assessment questions.
Research verification
WGU's 2026 institutional catalog identifies D338 as Cloud Platform Solutions, course ITCL
3204, worth three competency units. WGU's transfer guidelines recognize the Microsoft Azure
Administrator AZ-104 certification for this course.
Western Governors University
+1
Microsoft's official AZ-104 blueprint establishes five competencies. I have distributed the 100
original questions accordingly, with added emphasis on configuration decisions, troubleshooting,
security, and practical administrative scenarios.
Microsoft Learn
Section Questions Count
1. Azure identities and governance 1–23 23
2. Azure storage administration 24–41 18
3. Azure compute and application services 42–65 24
4. Virtual networking and connectivity 66–85 20
5. Monitoring, backup, and recovery 86–100 15
Total 100
Section 1. Manage Azure identities and governance
Questions 1–23 · Entra ID, RBAC, Azure Policy, subscriptions, management groups, resource
locks, and cost governance.
Question 1. Microsoft Entra ID user management
A company hires a new employee who requires an organizational identity to access Azure-
integrated applications. Which action should the administrator perform?
A. Create a virtual machine for the employee
, B. Create a user account in Microsoft Entra ID
C. Create a new Azure subscription
D. Create an Azure Storage account
Correct Answer: B
Rationale: Microsoft Entra ID provides cloud identity and access management. Creating a user
account establishes the employee's organizational identity, which can subsequently be assigned
authentication methods, licenses, group memberships, and permissions. Neither a subscription
nor a virtual machine creates an employee identity.
Question 2. Group-based licensing
An organization wants users in its Sales department to receive the same Microsoft 365 licenses
automatically when they join a particular group. What should the administrator configure?
A. Azure Policy assignment
B. Network security group
C. Group-based licensing in Microsoft Entra ID
D. Azure resource lock
Correct Answer: C
Rationale: Group-based licensing assigns supported product licenses to group members. Eligible
users inherit the licenses when added and can have inherited licenses removed when they leave.
This reduces administrative effort and avoids manually licensing each employee.
Question 3. External collaboration
A consulting firm needs temporary access to a company's Microsoft Entra-integrated
collaboration resources using consultants' existing organizational identities. Which capability is
most appropriate?
A. Microsoft Entra B2B collaboration
B. Azure Virtual Machine Scale Sets
C. Azure Load Balancer
D. Microsoft Entra device registration only
Correct Answer: A
Rationale: Microsoft Entra B2B collaboration allows external users to be invited as guests and
access authorized organizational resources. It supports collaboration without requiring the
consultants to become ordinary internal employees.
Question 4. Dynamic group membership
,An administrator wants users whose department attribute equals Finance to be added
automatically to a group. Which configuration should be used?
A. Assigned membership group with manual updates
B. Azure resource group
C. Azure Policy exemption
D. Dynamic membership group based on a user attribute rule
Correct Answer: D
Rationale: Microsoft Entra dynamic groups evaluate user attributes against configured
membership rules. When an eligible user's department matches the Finance rule, membership is
automatically processed. Dynamic membership requires the appropriate Microsoft Entra
licensing.
Question 5. Self-service password reset
Users frequently contact the help desk to reset forgotten passwords. The company wants eligible
users to reset their passwords securely without administrator involvement.
Which feature should be enabled?
A. Azure Resource Manager
B. Microsoft Entra self-service password reset
C. Azure Monitor metrics
D. Azure Application Gateway
Correct Answer: B
Rationale: Self-service password reset (SSPR) permits authorized users to recover or reset their
passwords after satisfying configured verification requirements. Administrators can scope SSPR
to eligible users or groups and configure acceptable authentication methods.
Question 6. Read-only Azure resource access
An auditor must view resource configurations in an Azure resource group but must not modify
its resources.
Which built-in Azure role provides the appropriate access?
A. Owner
B. Contributor
C. Reader
D. User Access Administrator
Correct Answer: C
, Rationale: The Reader role provides visibility into Azure resource configuration without
permission to perform resource modifications. Contributor and Owner provide substantially
broader management permissions, making them inappropriate for this read-only requirement.
Question 7. Contributor permissions
An engineer has the Contributor role assigned at a resource group scope. Which operation is the
engineer generally unable to perform through that role alone?
A. Create a virtual machine
B. Modify a storage account
C. Delete a permitted resource
D. Assign Azure RBAC roles to other users
Correct Answer: D
Rationale: Contributor can manage resources but cannot grant Azure RBAC permissions to other
identities. Role assignment management requires authorization such as Owner, User Access
Administrator, or a suitably configured Role Based Access Control Administrator role.
Question 8. Delegating role assignment administration
An administrator must allow a security operator to manage Azure RBAC role assignments within
one resource group without granting broad permissions to modify the workloads.
Which built-in role is appropriate?
A. User Access Administrator
B. Storage Blob Data Reader
C. Virtual Machine Contributor
D. Monitoring Reader
Correct Answer: A
Rationale: User Access Administrator can manage Azure access assignments at the granted
scope. Assigning this role at the specific resource group limits its authority to that scope and its
descendants. The other roles do not provide general RBAC assignment management.
Question 9. RBAC inheritance
A user receives the Reader role at the subscription level. The subscription contains several
resource groups and virtual machines.
What access does the user inherit?
A. Reader access only to newly created resource groups
