Free Azure AZ-104 Practice Test 2026: Are You Actually Ready?
Practice with real-format AZ-104 questions across all five domains. Detailed explanations included.
What If I Told You the AZ-104 Is Harder Than Most People Think?
Forget what Reddit told you about the AZ-104 being "just like AZ-900 but a bit harder." It's not. The jump from Azure Fundamentals to Azure Administrator is like going from driving in a parking lot to merging onto a highway at rush hour. Completely different game.
The AZ-104 is a role-based exam. Microsoft doesn't just want to know that you understand what a virtual network is — they want you to configure one, troubleshoot why it's not routing traffic, and explain what happens when you peer it with another VNet. Some questions even drop you into a live Azure portal lab.
That's why practice tests matter more for the AZ-104 than for almost any other Azure cert. You need to get comfortable with scenario-based questions that don't have obvious answers. Let me show you what I mean.
AZ-104 Exam Breakdown: The Five Domains
The AZ-104 covers five major areas. Understanding the weight of each helps you prioritize your study time.
| Domain | Weight | Difficulty Rating |
|---|---|---|
| Manage Azure identities and governance | 20-25% | ⭐⭐⭐ Medium |
| Implement and manage storage | 15-20% | ⭐⭐⭐ Medium |
| Deploy and manage Azure compute resources | 20-25% | ⭐⭐⭐⭐ Hard |
| Implement and manage virtual networking | 15-20% | ⭐⭐⭐⭐⭐ Hardest |
| Monitor and maintain Azure resources | 10-15% | ⭐⭐ Easier |
Networking is where most people fail. Not because the concepts are impossibly complex, but because there are so many interrelated components — NSGs, route tables, VNet peering, VPN gateways, Azure Firewall, Application Gateway, Load Balancer — and the exam expects you to know when to use which.
Sample AZ-104 Practice Questions
Here are questions that match the real exam in style and difficulty. Don't just read them — try to answer before checking.
Identity & Governance
Free AZ-104 Practice Questions
Question 1
You need to ensure that users from a partner organization can access resources in your Azure subscription without creating accounts in your Entra ID tenant. What should you configure?
Entra ID B2B collaboration allows external users to authenticate using their own organization's credentials without creating accounts in your tenant. It's designed specifically for cross-organization access scenarios.
Question 2
A virtual machine in Azure is running but you need to reduce costs during off-hours. Which feature should you implement?
Auto-shutdown schedules let you automatically stop VMs during off-hours to reduce compute costs. Reserved Instances are for long-term commitments, Spot VMs are for interruptible workloads, and Hybrid Benefit is for licensing savings.
Question 3
You need to deploy a custom ARM template that creates multiple resources. Where can you deploy an ARM template directly in the Azure portal?
The Azure portal allows direct ARM template deployment through the 'Deploy a custom template' option. While Cloud Shell and DevOps also support ARM deployments, the portal provides a direct GUI-based deployment experience.
Question 4
You have an Azure Storage account and need to ensure that data is encrypted with keys you manage. What should you configure?
Customer-managed keys (CMK) stored in Azure Key Vault give you full control over encryption keys for Azure Storage. Microsoft-managed keys are the default but don't give you key management control.
Question 5
You need to configure a Network Security Group (NSG) rule to allow HTTPS traffic from the internet to a subnet. Which port and source should you specify?
HTTPS uses port 443. The source 'Internet' service tag represents all public IP addresses. Port 80 is HTTP (not HTTPS), and VirtualNetwork would only allow internal traffic.
Question 6
You need to assign a user the ability to manage virtual machines but not other resources in a resource group. Which RBAC role should you assign?
Virtual Machine Contributor is a built-in RBAC role that lets users manage VMs but not access to them or the virtual network/storage they're connected to. Contributor would give broader access to all resource types.
Question 7
You configure Azure Monitor alerts for a web app. You want to be notified when CPU usage exceeds 90% for 5 minutes. What type of alert rule should you create?
Metric alerts with static thresholds monitor resource metrics like CPU percentage and trigger when the value exceeds a defined threshold for a specified period. Activity log alerts monitor management operations, not performance metrics.
Question 8
Your organization requires that all Azure resources must be deployed to specific regions only. How should you enforce this?
The built-in 'Allowed locations' Azure Policy restricts which regions resources can be deployed to. This is the most direct enforcement mechanism. RBAC controls who can do things, not where resources go.
Question 9
You need to create a DNS record for a web app so that users can access it via a custom domain. Which DNS record type should you create?
A CNAME record maps a custom domain name to the Azure Web App's default hostname (e.g., myapp.azurewebsites.net). MX is for mail, PTR for reverse lookups, and SRV for service discovery.
Question 10
You have a virtual network with two subnets. VMs in Subnet A cannot communicate with VMs in Subnet B. What is the most likely cause?
By default, all subnets within the same VNet can communicate with each other. If communication fails, it's most likely an NSG rule blocking the traffic. VNet peering is for connecting separate VNets, not subnets within the same VNet.
- A) VNet peering is not configured in both directions
- B) The VMs are in different availability zones
- C) The subnets don't have route tables
- D) The VMs don't have public IP addresses
Answer: A) VNet peering is not configured in both directions — VNet peering must be created from both sides. You need a peering connection from VNet1→VNet2 AND from VNet2→VNet1. This is the #1 gotcha with VNet peering. Availability zones (B) don't affect peering. Default routes handle peered VNets (C). Public IPs aren't needed for private peering (D).
These questions give you a taste of AZ-104 difficulty. For hundreds more, check out ExamCert's full AZ-104 practice test.
The Domains That Trip Everyone Up
Based on analyzing thousands of practice test results, here's where people consistently score lowest:
1. Networking (Lowest Average Scores)
It's not just VNets and NSGs. The AZ-104 tests complex networking scenarios:
- VNet peering vs VPN Gateway vs ExpressRoute — know when to use each
- Network Security Groups vs Application Security Groups — rule evaluation order matters
- Azure DNS — private zones, record types, zone delegation
- Load balancing — Standard LB vs Application Gateway vs Front Door vs Traffic Manager
My advice: spend 30% of your study time on networking even though it's only 15-20% of the exam. Getting comfortable here is what separates passers from failers.
2. Identity Edge Cases
Entra ID (formerly Azure AD) has a lot of nuance. Conditional Access policies, PIM (Privileged Identity Management), and RBAC custom roles are commonly tested. If you've only used basic Azure AD, this section will surprise you.
AZ-104 Lab-Based Questions: What Microsoft Really Tests
Unlike many IT exams, the AZ-104 includes lab-based case studies where you perform actual tasks in a simulated Azure portal. These questions can't be memorized — you need hands-on experience. Here's what to expect:
- Virtual Network configuration: Create VNets, configure peering, set up NSG rules, and troubleshoot connectivity. Practice with our Virtual Networking questions.
- Azure Active Directory: Create users, assign roles, configure conditional access policies, and manage guest accounts.
- Storage account management: Configure blob storage, set up replication, manage access keys, and implement lifecycle policies.
- VM deployment: Deploy VMs with specific configurations, set up availability sets, configure backup and disaster recovery.
💡 Tip: Microsoft offers a free Azure sandbox with $200 credit for 30 days. Use it alongside our practice questions. Theory + hands-on = passing formula.
How to Study for AZ-104 Effectively
The AZ-104 demands hands-on practice. No amount of reading will prepare you for lab questions where you're dropped into the actual Azure portal.
The 60/40 Rule
Spend 60% of your time on hands-on practice in the Azure portal and 40% on theory/practice questions. This ratio is critical. I've seen people score 90% on practice tests but fail the real exam because they couldn't navigate the portal under time pressure.
Free Azure Lab Options
- Azure Free Account — $200 credit for 30 days + 12 months of free services
- Microsoft Learn Sandboxes — free temporary Azure environments within Learn modules
- Azure for Students — $100 credit with no credit card (if eligible)
Study Timeline
- Weeks 1-2: Identity & governance + storage basics. Do the AZ-104 complete guide modules
- Weeks 3-4: Compute (VMs, VMSS, App Service, ACI, AKS) — lots of portal practice
- Weeks 5-6: Networking deep dive. Build VNets, configure peering, set up NSGs
- Weeks 7-8: Monitoring + review + practice tests. Target 80%+ on ExamCert practice tests
AZ-104 vs Other Azure Certifications
Wondering how the AZ-104 fits into the bigger picture? Here's the context:
- AZ-900 → AZ-104: The natural progression. AZ-900 vs AZ-104 comparison
- AZ-104 → AZ-305: Admin to Architect. AZ-104 vs AZ-305 guide
- AZ-104 vs AZ-204: Admin vs Developer paths. Detailed comparison
- AZ-104 vs AWS SAA-C03: Azure vs AWS intermediate certs. Cross-cloud comparison
The AZ-104 is the most versatile Azure certification. It opens doors to every advanced Azure path — architect, security, DevOps, or data. If you only get one Azure cert beyond fundamentals, this is the one.
Ready to Test Your AZ-104 Knowledge?
ExamCert has hundreds of AZ-104 practice questions with detailed explanations. Updated for 2026. Free to start.
Start Free AZ-104 Practice Test →AZ-104 Domain Weights & Study Priority
The AZ-104 exam covers five domains. Here's how to prioritize your study time based on weights:
1. Manage Azure Identities & Governance (20-25%) — Azure AD users/groups, RBAC, subscriptions, Azure Policy, management groups. High-weight and testable.
2. Implement & Manage Storage (15-20%) — Storage accounts, blob storage, Azure Files, storage security, redundancy options (LRS, GRS, ZRS).
3. Deploy & Manage Azure Compute (20-25%) — VMs, VM Scale Sets, App Service, containers (ACI, AKS), ARM templates, Bicep.
4. Implement & Manage Virtual Networking (15-20%) — VNets, NSGs, Azure DNS, VPN Gateway, load balancers, peering, Network Watcher.
5. Monitor & Maintain Azure Resources (10-15%) — Azure Monitor, Log Analytics, alerts, backup, Azure Site Recovery.
8-Week AZ-104 Study Plan for Working Professionals
Weeks 1-2: Azure AD & Governance — Set up an Azure Free Account. Learn Azure AD, RBAC, subscriptions, policies. Practice AZ-104 identity questions.
Weeks 3-4: Storage & Compute — Create storage accounts, configure blob tiers, deploy VMs, configure scale sets. Hands-on labs are essential here.
Weeks 5-6: Networking — Build VNets, configure NSGs, set up VPN gateways, implement load balancers. This domain trips people up — spend extra time on networking practice questions.
Weeks 7-8: Monitoring + Full Practice Exams — Study Azure Monitor, alerts, backup. Take full-length practice exams daily. Review the AZ-104 Complete Guide.
Azure Certification Path After AZ-104
AZ-305: Azure Solutions Architect Expert — The natural next step. Requires AZ-104 as a prerequisite. Design solutions for Azure infrastructure.
AZ-500: Azure Security Engineer — Specialize in Azure security. Great for those interested in cloud security roles. See our AZ-500 practice questions.
AZ-204: Azure Developer Associate — If you want to combine admin + dev skills. Different focus from AZ-104 — more coding, less infra.
AZ-400: Azure DevOps Engineer Expert — Combine AZ-104 + AZ-204 knowledge for DevOps specialization.
Top Free AZ-104 Study Resources
✅ ExamCert AZ-104 Practice Tests — 500+ free questions with explanations, exam simulation, progress tracking across all domains
✅ Microsoft Learn — Free official AZ-104 learning paths with sandboxed Azure labs
✅ Azure Free Account — $200 credit for 30 days + 12 months of free services for hands-on practice
✅ ExamCert AZ-104 Study Guide — Domain-by-domain study guide with tips from certified professionals
Ready to Pass Azure AZ-104?
Practice with 500+ free AZ-104 exam questions. Covers all 5 domains with detailed explanations and exam simulation mode.
Start Free Practice Test →Frequently Asked Questions
How hard is the AZ-104 exam?
The AZ-104 is a role-based associate-level exam and significantly harder than AZ-900. Expect hands-on scenario questions that require practical Azure experience. Most successful candidates study for 6-10 weeks.
What is the AZ-104 passing score?
You need 700 out of 1000 to pass. The exam typically has 40-60 questions and includes multiple choice, drag and drop, case studies, and potentially lab-based questions.
Is AZ-104 harder than AWS SAA-C03?
They're comparable in difficulty but different in style. AZ-104 is more hands-on and operational, while AWS SAA-C03 focuses more on architecture and design. AZ-104 may include live lab questions, making it feel harder for some.
Do I need AZ-900 before AZ-104?
No, AZ-900 is not a prerequisite. If you're new to Azure, taking AZ-900 first gives you a solid foundation. Experienced cloud professionals can skip directly to AZ-104.
How long should I study for AZ-104?
With Azure experience, 4-6 weeks of focused study is typical. Without experience, plan for 8-12 weeks. Hands-on practice in the Azure portal is essential — this isn't an exam you can pass by reading alone.
Is AZ-104 harder than AZ-900?
Yes, significantly. AZ-900 tests fundamental cloud concepts and can be passed with 2-3 weeks of study. AZ-104 requires hands-on Azure experience and deep knowledge of administration tasks. Most people need 6-8 weeks of dedicated study. If you haven't taken AZ-900 yet, start there — see our AZ-104 vs AZ-900 comparison.
What Azure certifications should I get after AZ-104?
After AZ-104, most people go for either AZ-305 (Solutions Architect) for architecture roles, AZ-500 (Security) for security specialization, or AZ-204 (Developer) if you code. All three build on AZ-104 knowledge.
How many questions are on the AZ-104 exam?
The AZ-104 exam typically has 40-60 questions, including multiple choice, drag-and-drop, case studies, and lab-based scenarios. You need 700 out of 1000 to pass (70%). The exam time is 120 minutes, but plan for extra time due to lab questions loading. Take our free AZ-104 practice test to simulate the real exam experience.
Related Azure & Cloud Certification Resources
- Azure AZ-104 Exam Overview — Complete exam guide with domain breakdown, study tips, and free practice questions
- Free AZ-104 Practice Test — 500+ practice questions with explanations
- Azure AZ-900 Fundamentals — Start with fundamentals if you're new to Azure
- Azure AZ-204 Developer — Next step for developers after AZ-104
- Azure AZ-305 Solutions Architect — Advanced architecture certification path
- Azure AZ-500 Security — Specialize in Azure security after AZ-104
- AWS SAA-C03 vs AZ-104 — Compare AWS and Azure administrator certifications
- How to Pass Azure AZ-900 in 2026 — Study guide for Azure Fundamentals
- Best IT Certification Practice App 2026 — Compare top exam prep tools
Studying for multiple clouds? Compare AWS SAA-C03 vs AZ-104 to decide which cloud administrator cert to pursue first. Or explore our Azure AZ-900 practice tests if you need the fundamentals first.