Questions & answers (free, no sign-in needed)
- View
10 beginner questions on the AZ-104 skills measured: Microsoft Entra users and Azure RBAC, resource locks, shared access signatures and blob lifecycle management, ARM templates and Bicep, App Service deployment slots, network security groups, Azure Bastion and Azure Backup.
Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.
The help desk spends hours resetting forgotten passwords. An administrator wants users to reset their own passwords after verifying their identity. What should the administrator configure?
- A. Microsoft Entra self-service password reset (SSPR) ✔ correct
- B. Microsoft Entra Privileged Identity Management
- C. An Azure Policy assignment on the subscription
- D. A ReadOnly lock on the user accounts
Answer: A. SSPR lets users reset or unlock their own accounts after passing configured authentication methods, without calling the help desk. Privileged Identity Management controls time-limited admin role activation instead.
Source: learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-howitworks · Domain: Manage Azure identities and governance
An administrator assigns a user the built-in Reader role at the subscription scope. What can the user do?
- A. View and change resources, but only in one resource group
- B. View resources in every resource group of the subscription, without changing them ✔ correct
- C. Create new resource groups, but not view existing ones
- D. Manage role assignments for other users in the subscription
Answer: B. Role assignments are inherited by lower scopes, so Reader at the subscription applies to all its resource groups and resources. Reader can view resources but cannot change them or grant access to others.
Source: learn.microsoft.com/en-us/azure/role-based-access-control/scope-overview · Domain: Manage Azure identities and governance
A ReadOnly lock on a resource lets authorized users read it, but prevents them from updating or deleting it.
- A. True ✔ correct
- B. False
Answer: A. True. ReadOnly means authorized users can read the resource but cannot update or delete it. The other lock type, CanNotDelete (Delete), still allows changes but blocks deletion.
Source: learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources · Domain: Manage Azure identities and governance
A company must give a partner read access to one blob container for the next 48 hours without sharing the storage account keys. What should the administrator create?
- A. A new storage account access key for the partner
- B. A storage firewall rule that allows all networks
- C. A shared access signature (SAS) with an expiry time ✔ correct
- D. A CanNotDelete lock on the storage account
Answer: C. A SAS grants limited, delegated access to storage resources with specific permissions and an expiry time, without exposing the account keys. Account keys give full access to the whole storage account.
Source: learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview · Domain: Implement and manage storage
Which Azure Blob Storage feature can automatically move blobs to the Cool tier when they have not been modified for 90 days?
- A. Blob versioning
- B. Object replication
- C. Soft delete for blobs
- D. Lifecycle management policies ✔ correct
Answer: D. Lifecycle management policies use rules (for example, days since last modification) to move blobs to cooler tiers or delete them. Versioning and soft delete protect data; object replication copies blobs to another account.
Source: learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview · Domain: Implement and manage storage
A team wants to test a new version of its App Service web app in a staging environment and then move it into production with no downtime. Which feature should they use?
- A. Deployment slots with a swap ✔ correct
- B. Scale out the App Service plan
- C. A custom domain and TLS binding
- D. App Service backup and restore
Answer: A. Deployment slots are live apps with their own host names. You deploy to a staging slot, validate it, and swap it with production; the swap warms up instances first, so there is no downtime.
Source: learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots · Domain: Deploy and manage Azure compute resources
An administrator wants to deploy Azure resources repeatably from declarative files kept in source control. Which two file types can Azure Resource Manager deploy? (Select TWO)
- A. Azure Resource Manager (ARM) templates in JSON ✔ correct
- B. Bicep files ✔ correct
- C. Azure Monitor workbooks
- D. Network Watcher packet captures
- E. Recovery Services vault backup reports
Answer: A, B. ARM templates (JSON) and Bicep files both declare the resources to deploy; Bicep is a more concise language that compiles to an ARM template. Workbooks, packet captures and backup reports are not deployment files.
Source: learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/overview · Domain: Deploy and manage Azure compute resources
An administrator must allow only inbound HTTPS (TCP 443) traffic to the virtual machines in a subnet. What should they configure?
- A. An Azure DNS private zone linked to the virtual network
- B. A network security group with an inbound security rule ✔ correct
- C. A route table with a user-defined route
- D. A Standard SKU public IP address
Answer: B. A network security group (NSG) contains security rules that allow or deny traffic by source, destination, port and protocol, and can be associated with a subnet or network interface. Route tables control routing, not filtering.
Source: learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview · Domain: Implement and manage virtual networking
Administrators need RDP and SSH access to virtual machines from the Azure portal, without giving the VMs public IP addresses. Which service provides this?
- A. Azure Load Balancer
- B. Virtual network peering
- C. Azure Bastion ✔ correct
- D. Azure DNS
Answer: C. Azure Bastion is a managed service that provides secure RDP and SSH connectivity to VMs over TLS from the portal, so the VMs do not need public IP addresses. Peering only connects virtual networks.
Source: learn.microsoft.com/en-us/azure/bastion/bastion-overview · Domain: Implement and manage virtual networking
An administrator wants to back up an Azure virtual machine with Azure Backup from the Azure portal. Which resource stores the VM's recovery points?
- A. A Log Analytics workspace
- B. An Azure Key Vault
- C. An Azure Container Registry
- D. A Recovery Services vault ✔ correct
Answer: D. A Recovery Services vault stores the recovery points created over time and is where you configure VM backup and restore. Log Analytics stores logs, and Key Vault stores secrets, keys and certificates.
Source: learn.microsoft.com/en-us/azure/backup/quick-backup-vm-portal · Domain: Monitor and maintain Azure resources
Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public Microsoft exam objectives (Skills measured as of 2026-04-17), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by Microsoft; exam names are trademarks of their owners. Official exam page: learn.microsoft.com/en-us/credentials/certifications/resources/study-g.