Free Azure AZ-104 Practice Exam 2026 — Real Administrator Questions Across All 5 Domains
AZ-104 is the hands-on Azure exam. These practice questions test the configurations, troubleshooting scenarios, and Azure service decisions that appear on the real exam.
AZ-104 vs AZ-900 — Understanding What You're Preparing For
AZ-900 (Azure Fundamentals) tests concepts. AZ-104 (Azure Administrator) tests real-world job skills. The difference is significant: AZ-900 asks "What is Azure Blob Storage?" AZ-104 asks "A storage account needs to retain data for 30 days with immutability and legal holds — which access tier and policy should you configure?"
This means preparation strategy changes completely. You can't pass AZ-104 by reading alone. You need hands-on experience with Azure Portal, Azure CLI, and PowerShell commands. Get a free Azure account ($200 credit for 30 days) and build every service you study. Nothing cements Azure knowledge like configuring it yourself.
AZ-104 Exam Domains 2026
| Domain | Weight | Key Areas |
|---|---|---|
| Manage Azure Identities & Governance | 20-25% | Entra ID, RBAC, subscriptions, policies |
| Implement and Manage Storage | 15-20% | Storage accounts, blobs, files, queues |
| Deploy and Manage Azure Compute | 20-25% | VMs, App Service, containers, AKS |
| Implement and Manage Virtual Networking | 15-20% | VNets, NSGs, load balancers, DNS, VPN |
| Monitor and Maintain Azure Resources | 10-15% | Azure Monitor, alerts, backups, policies |
Free AZ-104 Practice Questions — Identity & Governance
Question 1 — RBAC
A developer needs to deploy resources to an Azure subscription but should not be able to assign roles to other users. Which built-in Azure role BEST meets this requirement?
Contributor can create and manage all resources but cannot grant access to others. Owner can do everything including role assignment. User Access Administrator can only manage user access, not create resources. Reader can only view. The RBAC role hierarchy is heavily tested on AZ-104: Owner > Contributor > Reader, with User Access Administrator being orthogonal. Know what each built-in role can and cannot do.
Question 2 — Azure Policy
An organization wants to ensure that all Azure resources are tagged with a "CostCenter" tag at creation time. Non-compliant resources should be automatically remediated. Which Azure Policy effect BEST achieves this?
Modify adds, updates, or removes properties on resources — perfect for adding tags during creation and for remediating existing non-compliant resources. Audit only reports non-compliance without fixing it. Deny blocks the resource creation entirely. DeployIfNotExists deploys a related resource if one doesn't exist (not for tag management). Azure Policy effects — Audit, AuditIfNotExists, Deny, Modify, DeployIfNotExists, Append — are a common AZ-104 exam topic.
Free AZ-104 Practice Questions — Virtual Networking
Question 3 — Network Security Groups
A VM in a subnet has an NSG applied at the subnet level allowing all inbound traffic on port 443. The VM's NIC also has an NSG applied that denies inbound traffic on port 443 with a priority of 100. What happens when traffic reaches port 443 on the VM?
For inbound traffic: subnet NSG is evaluated first, then NIC NSG. Traffic must pass BOTH NSGs. If the subnet allows port 443 but the NIC denies it with priority 100, the NIC-level deny takes effect — traffic is denied. For outbound traffic: NIC NSG first, then subnet NSG. NSG processing order is one of the most-tested AZ-104 networking topics. Both NSGs must allow traffic for it to reach the VM.
Question 4 — Azure Storage
An organization stores archived compliance documents in Azure Blob Storage. The documents are accessed less than once per year. Which storage access tier provides the LOWEST cost for this scenario?
Azure Blob Storage tiers by cost (storage vs. access): Hot = highest storage cost, lowest access cost (frequently accessed). Cool = lower storage, higher access (infrequently accessed, accessed ~monthly). Cold = lower storage, higher access costs (accessed a few times per year, min 90-day retention). Archive = lowest storage cost, highest access cost and latency (accessed less than once per year, 180-day min retention). For annual or less access, Archive has the lowest storage cost by far — perfect for compliance archives.
Question 5 — Virtual Machines
An Azure VM needs to be accessible from the internet on port 80 but should automatically shut down at 7 PM every day to reduce costs. The VM must restart manually each morning. Which Azure feature handles the scheduled shutdown?
Azure VMs have a built-in Auto-shutdown feature (under Operations in the VM blade) that can schedule daily shutdown at a specific time. It only handles shutdown — restart remains manual. This is the simplest and most direct answer. Azure Automation (A) works but is overkill for a simple daily shutdown. Policy (C) is for governance, not scheduling. Scale Sets (D) scale VM counts, not schedule individual VM shutdowns.
AZ-104 Study Strategy — What Actually Works
Hands-On Labs Are Not Optional
Every topic you study, open Azure Portal and do it. Create a VNet. Configure an NSG rule. Deploy a VM. Set up a storage account lifecycle policy. The AZ-104 exam uses screenshots and scenario descriptions of Azure Portal states — if you've seen and configured these yourself, you'll recognize them instantly.
Use Microsoft Learn
Microsoft's own free learning paths for AZ-104 are excellent and include sandbox environments. Work through all 5 learning paths. They're updated with each Azure service update and aligned to current exam objectives.
Practice, Then Review Wrong Answers
Doing practice questions matters — but reviewing wrong answers matters more. For every wrong answer, understand not just what the right answer is, but why the wrong answers were wrong. This pattern recognition is what the real exam tests.
AZ-104 high-yield topics: RBAC role assignments and scope, NSG inbound/outbound rule processing, Azure Policy effects (Audit/Deny/Modify), VNet peering, Azure Bastion vs JIT access, VM availability sets vs zones vs scale sets, and Azure Monitor alerts. These topics appear disproportionately on the exam.
ExamCert's AZ-104 Coverage
- AZ-104 Full Practice Test — 800+ questions, all 5 domains
- Azure AZ-104 Complete Guide — Domain-by-domain coverage
- AZ-104 Free Practice Test 2026 — Additional free questions
- AZ-104 vs AZ-900 — Which First? — Certification path guide
- AWS SAA vs AZ-104 — Which First? — Multi-cloud comparison
Ready to Pass AZ-104 Azure Administrator?
ExamCert has 800+ AZ-104 practice questions across all 5 domains — scenario-based, updated for 2026, with detailed explanations. Free to start, $4.99 for full access with a 100% money-back guarantee.
Start Free AZ-104 Practice ExamFrequently Asked Questions — AZ-104 Practice Exam
How hard is the AZ-104 exam in 2026?
AZ-104 is one of the harder Azure associate exams. It requires hands-on Azure experience — theory alone won't pass it. Most candidates need 3-6 months of Azure practice plus 4-8 weeks of dedicated study.
What is the AZ-104 passing score?
700 out of 1000. Scoring consistently 80%+ on ExamCert AZ-104 practice tests before your exam date is a reliable readiness indicator.
Should I get AZ-900 before AZ-104?
Not required, but recommended for Azure newcomers. Experienced IT professionals often skip AZ-900 and go straight to AZ-104. See our AZ-104 vs AZ-900 guide for the decision.
How long is the AZ-104 exam?
150 minutes, 40-60 questions including case studies. Read case study scenarios carefully before answering — you cannot return to previous questions within a case study section.
Is AZ-104 worth getting in 2026?
Yes. Azure is the #2 cloud platform globally and growing. AZ-104 certified Azure Administrators earn $95,000-$130,000 USD on average. It opens doors to senior cloud engineering and DevOps roles.