The Microsoft Azure Administrator Associate certification validates your ability to implement, manage, and monitor Azure environments. The AZ-104 (Microsoft Azure Administrator Exam) is the primary credential for professionals responsible for managing Azure subscriptions, securing identities, and maintaining cloud infrastructure. This page outlines the exam structure, core topics, and preparation strategies to help you study effectively and pass with confidence.
Use this topic map to guide your study for Microsoft AZ-104 (Microsoft Azure Administrator Exam) within the Azure Administrator Associate path.
The AZ-104 exam uses multiple question types to assess both conceptual knowledge and practical decision-making in real-world Azure scenarios.
Questions increase in complexity, moving from basic recall to multi-step problem-solving that mirrors actual administrator responsibilities.
An effective study plan breaks the five core topics into manageable weekly goals, combines theory with hands-on practice, and includes timed assessments to build exam readiness. Allocate more time to topics that require configuration skills, such as virtual networking and storage management.
Explore other Microsoft certifications: view all Microsoft exams.
Strengthen your preparation with up-to-date resources from validexamdumps.com. These materials align to AZ-104 and cover practical scenarios with clear explanations.
Visit the exam page to download the PDF, Online Practice Test, or get a Bundle Discount offer for both formats: Microsoft Azure Administrator Exam.
Virtual networking and compute resources typically account for a larger percentage of exam questions because these skills form the foundation of Azure infrastructure management. However, all five domains are tested, so balanced preparation across all topics is essential. Review the official exam skills outline to confirm the current weighting.
In practice, these domains overlap significantly. For example, you deploy compute resources (VMs) within a virtual network, apply RBAC to control who can access them, store application data in managed storage accounts, and use monitoring to track performance. Understanding these connections helps you answer scenario-based questions that test integrated knowledge rather than isolated facts.
Hands-on experience is highly valuable for the AZ-104 exam, especially for simulation-style questions. Prioritize labs that involve configuring virtual networks, deploying and scaling VMs, setting up RBAC and conditional access, managing storage accounts, and creating monitoring alerts. Microsoft Learn provides free sandbox environments where you can practice these tasks risk-free.
Frequent errors include misunderstanding RBAC scope and inheritance, confusing network security group rules with firewall settings, overlooking replication and backup requirements for storage, and underestimating the importance of monitoring and diagnostics. Carefully read scenario questions to identify all constraints and requirements before selecting an answer.
In your final week, focus on weak areas identified during practice tests rather than re-reading all material. Take a full-length timed practice test mid-week to gauge readiness and adjust focus accordingly. Review explanations for any missed questions, and do a quick refresh of key terminology and command-line syntax the day before your exam to stay sharp without overloading your memory.
Yon have an Azure Storage account named storage1 that contains a blob container named comainer1. You need to prevent new content added to contalner1 from being modified for one year. What should you configure?
In Azure Storage, to ensure that newly added content cannot be modified or deleted for a fixed retention period, you must configure a container-level immutable storage policy, also known as a time-based retention policy or immutability policy. This feature is implemented through a stored access policy in Azure Blob Storage using the WORM (Write Once, Read Many) capability.
According to Microsoft's Azure Storage documentation, immutability policies can be configured in two ways:
Time-based retention policy -- prevents data from being modified or deleted for a fixed duration (e.g., 1 year).
Legal hold -- preserves data until the hold is explicitly cleared.
To implement the time-based retention policy, you configure a container-level access policy under Immutable blob storage settings. Once configured, any new blobs written to the container will be locked for the specified retention period and cannot be modified or deleted, ensuring compliance with retention regulations like SEC 17a-4(f) or GDPR.
The access level, access tier, or IAM settings do not provide this immutability. They control access permissions, performance, and user roles but do not enforce write-once protection.
Thus, the correct approach is to configure an access policy that enforces immutability for one year.
You need to configure an Azure web app named contoso.azurewebsites.net to host www.contoso.com.
What should you do first?
When you configure a custom domain (like www.contoso.com) for an Azure Web App (App Service), Azure requires that the domain be verified to ensure ownership before binding it to the app.
According to Microsoft Azure official documentation (''Map a custom domain name to your Azure web app'' --- Microsoft Learn):
''Before you can add a custom domain, you must verify that you own the domain name by creating a DNS record with your domain registrar. Azure uses an asuid verification record, which can be either a CNAME or TXT record, depending on your DNS provider.''
The first step is to create a CNAME or TXT record in your DNS zone that links your custom domain to the Azure verification ID.
The record name is asuid.contoso.com.
The value (target) is the domain verification ID shown in the Azure portal under Custom domains Custom hostnames Domain ownership.
Once Azure verifies the domain ownership using that record, you can add www.contoso.com as a custom hostname in the web app configuration.
Key Point:
Step 1: Verify domain ownership using a CNAME or TXT record.
Step 2: Bind the custom hostname (www.contoso.com) to your web app.
Thus, the correct and verified answer is: A. Create a CNAME record named asuid that contains the domain verification ID.
You have an Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address.
The virtual machines host several applications that are accessible over port 443 to user on the Internet.
Your on-premises network has a site-to-site VPN connection to VNet1.
You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network.
You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accesses by the Internet users.
What should you do?
You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources.
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the internet. And this can be achieved by configuring a deny rule in a network security group (NSG) that is linked to Subnet1 for RDP / SSH protocol coming from internet.
Modify the address space of Subnet1 :Incorrect choice
Modifying the address space of Subnet1 will have no impact on RDP traffic flow to the virtual network.
Modify the address space of the local network gateway :Incorrect choice
Modifying the address space of the local network gateway will have no impact on RDP traffic flow to the virtual network.
Remove the public IP addresses from the virtual machines :Incorrect choice
If you remove the public IP addresses from the virtual machines, none of the applications be accessible publicly by the Internet users.
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
You have an Azure subscription.
Your company has three external partners. You plan to deploy 10 virtual machines that will be used by the partners.
You need to ensure that you can track the partners' use of the virtual machines by using Microsoft Cost Management. The solution must minimize administrative effort.
What should you do first?
The correct first step is to create a tag for each partner. Azure tags are key-value metadata pairs applied to Azure resources to identify resources based on organizational criteria, such as department, environment, owner, or cost center. Microsoft Cost Management can use tags to group, filter, allocate, and analyze costs, which makes tags the appropriate mechanism for tracking virtual machine usage and cost by external partner. Microsoft's Cost Management guidance states that tags are key-value pairs applied to Azure resources to group and allocate costs based on business needs.
You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual machines.
You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text.
What should you create to store the password?
According to the Microsoft Azure Administrator (AZ-104) study guide and Azure documentation, when deploying Azure resources through ARM templates, sensitive information such as administrative passwords must not be stored in plain text within the template or parameter files.
To securely store and reference such secrets, Azure Key Vault is the recommended service.
Azure Key Vault is a cloud service designed to store and manage secrets, encryption keys, and certificates securely. By integrating Key Vault with Azure Resource Manager templates, you can:
Securely store passwords as secrets.
Reference them dynamically in the template using a secure URI (reference function).
Ensure the secret value is not exposed in deployment logs or ARM code.
Control access using Access Policies or Azure RBAC.
The parameter section of the ARM template would reference the Key Vault as follows:
'adminPassword': {
'reference': {
'keyVault': {
'id': '/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<keyvault-name>'
},
'secretName': 'AdminPassword'
}
}
Thus, storing the administrative password in Azure Key Vault with a properly defined access policy is the Microsoft-verified, secure, and compliant approach.
Final Verified Answe r: C. an Azure Key Vault and an access policy
