CertifyDeckCargando contenido…
AZ-104 · Sample questions
10 real questions from the CertifyDeck AZ-104 bank, spread across the domains of the official Azure Administrator skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: A. Only the rows with the invalid domain fail and are reported in a downloadable results file, while valid rows are created successfully
The bulk create process validates each row independently; rows that fail (e.g., due to an unverified UPN domain) are skipped and listed in a downloadable results/error file, while all valid rows are still processed and created. B is wrong because the whole job does not abort on a per-row failure. C is wrong because failing rows are not created at all, not created-but-disabled. D is wrong because Entra ID does not silently rewrite UPN domains during import; it flags them as errors instead.
Correct answer: A. Azure RBAC assignments can be scoped narrowly (down to a single resource), while Microsoft Entra role assignments are typically tenant-wide or scoped to administrative units
Azure RBAC supports a fine-grained scope hierarchy from management group down to an individual resource, while Microsoft Entra roles are generally tenant-wide, with administrative units providing a coarser mechanism to scope certain Entra roles to a subset of users/groups/devices. B is wrong, Azure RBAC clearly supports finer granularity than tenant-wide. C is wrong, Azure RBAC assignments can be made at many scopes, not only management group level. D is wrong, Microsoft Entra roles cannot be scoped to a specific Azure resource like a VM; that is an Azure RBAC concept.
Correct answer: B. 11
A /28 subnet has 16 total addresses (2^4). Azure always reserves 5 addresses in every subnet: the network address, the default gateway, two addresses reserved for Azure's internal DNS mapping, and the broadcast address. 16 - 5 = 11 usable addresses for NICs. C (13) would be the result of only subtracting 3 reserved addresses, which is incorrect for Azure. A (16) ignores reservations entirely. D (8) corresponds to a /29 subnet.
Correct answer: A. Azure Firewall Policy, which can be created once and associated with multiple Azure Firewall instances for centralized rule management
Azure Firewall Policy is a top-level resource containing NAT, network, and application rule collections (plus settings like threat intelligence and TLS inspection) that can be associated with multiple Azure Firewall instances, enabling centralized, consistent rule management across a multi-firewall, multi-region deployment, often paired with Firewall Manager for broader governance. B is false; this centralized policy capability exists precisely to avoid independent per-instance configuration. C and D are unrelated Azure services, dealing with cost tracking and connectivity monitoring respectively, not firewall rule management.
Correct answer: A. Add a virtual network rule for the VM subnet after enabling a service endpoint for Microsoft.Storage on that subnet
To securely allow traffic from a specific VNet subnet, you enable the Microsoft.Storage service endpoint on that subnet and then add a virtual network rule on the storage account firewall for that subnet. Traffic then routes over the Azure backbone with the subnet's identity, not a public IP. B defeats the purpose of the firewall by opening it to the internet. C is unreliable because VM traffic to Azure services typically does not use a stable public IP in the way expected, and it does not leverage the more secure VNet integration. D is a bad security practice and unnecessary.
Correct answer: A. Public network access is enabled from all networks
By default, new storage accounts allow public network access from all networks (subject to authentication with keys, SAS, or Entra ID). Administrators must explicitly restrict access using the firewall (selected networks/IPs) or Private Endpoints if they want to limit connectivity. B is wrong because access is not disabled by default. C is wrong because selecting specific VNets is an opt-in restriction, not the default. D is wrong because Private Endpoints must be created and configured manually; they are not present by default.
Correct answer: A. Read/Write
Read/Write is the default and recommended host caching option for OS disks in most scenarios, providing the best balance of performance for typical read and write patterns. Read-only caching is recommended for data disks holding read-heavy workloads (e.g., database data files), not general OS disks. None disables caching, which can hurt performance unnecessarily for an OS disk. Write-only is not an option Azure offers for managed disk host caching (only None, Read-only, Read/Write).
Correct answer: A. Availability zones
Availability zones are physically separate datacenters (each with independent power, cooling, and networking) within the same Azure region, protecting against a full datacenter-level failure. Availability sets only protect against rack/hardware-level failures within a single datacenter, not a full datacenter outage. Proximity placement groups are used to minimize network latency by co-locating VMs, the opposite goal of resiliency-driven separation. Azure Bastion is a secure remote-access service unrelated to availability architecture.
Correct answer: A. Perf | where TimeGenerated > ago(6h) and CounterName == "% Processor Time" | summarize avg(CounterValue) by Computer, bin(TimeGenerated, 15m)
Option A correctly filters by time range and counter, then uses summarize avg() with bin() to bucket results into 15-minute intervals grouped by Computer, which is the standard KQL pattern for time-bucketed aggregation. B is wrong: it only projects and sorts raw values, no aggregation or time bucketing. C is wrong: 'where' after 'summarize' cannot filter on TimeGenerated because that column is no longer in the result set after aggregation. D is wrong: 'top 15' returns the 15 highest values, not a 15-minute time bucket, misinterpreting the requirement entirely.
Correct answer: A. File Recovery, which mounts the recovery point as a local drive and lets you browse and copy individual files/folders
File Recovery downloads a script that mounts the recovery point's disks as a local drive on a machine, letting the administrator browse the file system and copy out only the specific files/folders needed, without a full VM or disk restore. B is wrong: creating a new VM restores the entire VM, far more than a single file, and is unnecessary overhead for this need. C is wrong: replacing the existing VM overwrites production disks entirely, a drastic operation not needed for retrieving one file. D is wrong: restoring disks only creates new managed disks, which still requires attaching them to a VM to browse files, it's not the direct file-level recovery experience.
Answer each question before opening the explanation, and write down why you discarded the other options. On AZ-104, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official AZ-104 format.