1
AZ-104 RENEWAL EXAM 2026/2027 | MICROSOFT
AZURE ADMINISTRATOR | EXPERT VERIFIED | 60
QUESTIONS & COMPLETE RATIONALES | PASS
GUARANTEED - A+ GRADED
SECTION 1: MANAGE AZURE IDENTITIES & GOVERNANCE (Questions 1-12)
This domain represents 20-25% of the exam content .
Q1: You have an Azure subscription containing a resource group named RG-Prod. You need to ensure that a
user named User1 can only manage virtual machines in RG-Prod, and cannot create or delete other resource
types. Which role assignment should you use?
A. Contributor role at the subscription level
B. Virtual Machine Contributor role at the resource group level
C. Owner role at the resource group level
D. Reader role at the subscription level
Correct Answer: B
Rationale: The Virtual Machine Contributor role provides permissions to manage virtual machines but not
the ability to manage other resource types like storage accounts or virtual networks . Assigning at the resource
group scope (RG-Prod) limits the permissions to that specific resource group. The Contributor role (A) would
allow management of all resource types. Owner (C) grants full access including role assignments. Key
teaching point: Use built-in roles at the appropriate scope to grant least-privilege access.
Q2: You need to ensure that resources deployed in your subscription cannot be deleted accidentally. You want
to allow authorized users to delete resources only after a specific action is taken. Which Azure feature should
you use?
A. Azure Policy
B. Resource locks
C. Role-Based Access Control (RBAC)
D. Management groups
Correct Answer: B
Rationale: Resource locks prevent accidental deletion or modification of resources. A delete lock prevents
deletion but allows modifications; a read-only lock prevents both. Unlike RBAC (C), locks apply to all users
,2
regardless of their role assignments . Key teaching point: Resource locks provide an additional layer of
protection beyond RBAC and apply to all users.
Q3: You have 10 Azure subscriptions across multiple departments. You need to apply a consistent set of
policies (e.g., allow only certain VM sizes, enforce tags) across all subscriptions. What is the most efficient way
to achieve this?
A. Configure Azure Policy at the management group level
B. Create an Azure Blueprint
C. Apply policies individually to each subscription
D. Use Azure Resource Manager templates
Correct Answer: A
Rationale: Management groups provide a hierarchy above subscriptions, allowing policies to be applied at
scale. Applying Azure Policy at a management group level ensures compliance across all subscriptions under
that group. Blueprints (B) are used to package and deploy resources, not enforce ongoing compliance . Key
teaching point: Management groups enable policy enforcement across multiple subscriptions.
Q4: A user in your organization has left the company. You need to ensure they cannot access Azure resources,
but you must maintain audit logs of their previous activities. What should you do?
A. Delete the user account
B. Disable the user account
C. Remove all role assignments
D. Reset the user password
Correct Answer: B
Rationale: Disabling the user account prevents sign-in while preserving the user object and its audit history.
Deleting (A) removes the account and its associated audit trail. Removing role assignments (C) alone would
leave the account active and able to sign in . Key teaching point: Disable, don't delete, to preserve audit
history.
Q5: You are configuring role assignments for a new project. Which of the following scopes can you use when
assigning an RBAC role? (Select all that apply.)
A. Management group
B. Subscription
C. Resource group
, 3
D. Individual resource
E. Tenant
Correct Answers: A, B, C, D
Rationale: RBAC roles can be assigned at multiple scopes: management group, subscription, resource group,
and individual resource . The hierarchy allows permissions to be inherited from higher levels. Tenant-level
assignments are not a standard RBAC scope. Key teaching point: RBAC can be assigned at management
group, subscription, resource group, or resource scope.
Q6: You have an Azure subscription with a budget of $10,000 per month. You need to receive an alert when
the spending exceeds 80% of the budget. What should you configure?
A. Azure Policy
B. Azure Cost Management budget alert
C. Azure Monitor alert
D. Azure Advisor recommendation
Correct Answer: B
Rationale: Azure Cost Management allows you to configure budgets and alerts based on spending thresholds.
You can set alerts at 50%, 75%, 80%, 90%, and 100% of the budget. Azure Monitor (C) handles performance
and availability monitoring . Key teaching point: Cost Management budgets provide spending alerts based
on configured thresholds.
Q7: A user is unable to reset their password using self-service password reset (SSPR). Which of the following
is a prerequisite for SSPR to function?
A. Azure AD Premium P1 or P2 license
B. Global Administrator role assigned
C. MFA registration complete
D. Both A and C
Correct Answer: D
Rationale: SSPR requires Azure AD Premium P1 or P2 licensing and users must register for self-service
password reset, which includes MFA authentication methods. Global Administrator (B) is not required for all
users; it's needed only for configuration . Key teaching point: SSPR requires Azure AD Premium licensing
and user registration.
AZ-104 RENEWAL EXAM 2026/2027 | MICROSOFT
AZURE ADMINISTRATOR | EXPERT VERIFIED | 60
QUESTIONS & COMPLETE RATIONALES | PASS
GUARANTEED - A+ GRADED
SECTION 1: MANAGE AZURE IDENTITIES & GOVERNANCE (Questions 1-12)
This domain represents 20-25% of the exam content .
Q1: You have an Azure subscription containing a resource group named RG-Prod. You need to ensure that a
user named User1 can only manage virtual machines in RG-Prod, and cannot create or delete other resource
types. Which role assignment should you use?
A. Contributor role at the subscription level
B. Virtual Machine Contributor role at the resource group level
C. Owner role at the resource group level
D. Reader role at the subscription level
Correct Answer: B
Rationale: The Virtual Machine Contributor role provides permissions to manage virtual machines but not
the ability to manage other resource types like storage accounts or virtual networks . Assigning at the resource
group scope (RG-Prod) limits the permissions to that specific resource group. The Contributor role (A) would
allow management of all resource types. Owner (C) grants full access including role assignments. Key
teaching point: Use built-in roles at the appropriate scope to grant least-privilege access.
Q2: You need to ensure that resources deployed in your subscription cannot be deleted accidentally. You want
to allow authorized users to delete resources only after a specific action is taken. Which Azure feature should
you use?
A. Azure Policy
B. Resource locks
C. Role-Based Access Control (RBAC)
D. Management groups
Correct Answer: B
Rationale: Resource locks prevent accidental deletion or modification of resources. A delete lock prevents
deletion but allows modifications; a read-only lock prevents both. Unlike RBAC (C), locks apply to all users
,2
regardless of their role assignments . Key teaching point: Resource locks provide an additional layer of
protection beyond RBAC and apply to all users.
Q3: You have 10 Azure subscriptions across multiple departments. You need to apply a consistent set of
policies (e.g., allow only certain VM sizes, enforce tags) across all subscriptions. What is the most efficient way
to achieve this?
A. Configure Azure Policy at the management group level
B. Create an Azure Blueprint
C. Apply policies individually to each subscription
D. Use Azure Resource Manager templates
Correct Answer: A
Rationale: Management groups provide a hierarchy above subscriptions, allowing policies to be applied at
scale. Applying Azure Policy at a management group level ensures compliance across all subscriptions under
that group. Blueprints (B) are used to package and deploy resources, not enforce ongoing compliance . Key
teaching point: Management groups enable policy enforcement across multiple subscriptions.
Q4: A user in your organization has left the company. You need to ensure they cannot access Azure resources,
but you must maintain audit logs of their previous activities. What should you do?
A. Delete the user account
B. Disable the user account
C. Remove all role assignments
D. Reset the user password
Correct Answer: B
Rationale: Disabling the user account prevents sign-in while preserving the user object and its audit history.
Deleting (A) removes the account and its associated audit trail. Removing role assignments (C) alone would
leave the account active and able to sign in . Key teaching point: Disable, don't delete, to preserve audit
history.
Q5: You are configuring role assignments for a new project. Which of the following scopes can you use when
assigning an RBAC role? (Select all that apply.)
A. Management group
B. Subscription
C. Resource group
, 3
D. Individual resource
E. Tenant
Correct Answers: A, B, C, D
Rationale: RBAC roles can be assigned at multiple scopes: management group, subscription, resource group,
and individual resource . The hierarchy allows permissions to be inherited from higher levels. Tenant-level
assignments are not a standard RBAC scope. Key teaching point: RBAC can be assigned at management
group, subscription, resource group, or resource scope.
Q6: You have an Azure subscription with a budget of $10,000 per month. You need to receive an alert when
the spending exceeds 80% of the budget. What should you configure?
A. Azure Policy
B. Azure Cost Management budget alert
C. Azure Monitor alert
D. Azure Advisor recommendation
Correct Answer: B
Rationale: Azure Cost Management allows you to configure budgets and alerts based on spending thresholds.
You can set alerts at 50%, 75%, 80%, 90%, and 100% of the budget. Azure Monitor (C) handles performance
and availability monitoring . Key teaching point: Cost Management budgets provide spending alerts based
on configured thresholds.
Q7: A user is unable to reset their password using self-service password reset (SSPR). Which of the following
is a prerequisite for SSPR to function?
A. Azure AD Premium P1 or P2 license
B. Global Administrator role assigned
C. MFA registration complete
D. Both A and C
Correct Answer: D
Rationale: SSPR requires Azure AD Premium P1 or P2 licensing and users must register for self-service
password reset, which includes MFA authentication methods. Global Administrator (B) is not required for all
users; it's needed only for configuration . Key teaching point: SSPR requires Azure AD Premium licensing
and user registration.
