AZ-104 RENEWAL EXAM 2026 UPDATED
QUESTIONS AND ANSWERS | MICROSOFT
AZURE ADMINISTRATOR | VERIFIED
MULTIPLE CHOICE EXAM GUIDE | 100%
ACCURATE SOLUTIONS
• This AZ-104 Renewal Exam Guide contains 200 carefully curated, verified multiple-
choice questions covering all domains tested in the Microsoft Azure Administrator
certification exam — ideal for focused, exam-ready preparation.
• Study by attempting each question independently before checking the highlighted
correct answer and EXPERT RATIONALE below it — this active recall method
maximizes retention and builds real exam confidence.
1. You need to create a new Azure subscription. Which of the following is
required?
A. An Azure Active Directory tenant
B. A valid credit card or payment method
C. A Microsoft account or work/school account
D. An existing Azure resource group
E. A dedicated Azure region selection
C. A Microsoft account or work/school account
EXPERT RATIONALE: To create an Azure subscription, you need a Microsoft account or a
work/school account (Azure AD account). This is the fundamental identity requirement to
access and manage Azure services.
2. You are managing Azure AD users. A user reports they cannot sign in. You
check and the user account is enabled. What should you check next?
A. Whether the user has a valid Azure subscription
B. Whether the user's password has expired or needs reset
,C. Whether the resource group the user belongs to is locked
D. Whether the user's virtual machine is running
E. Whether the user has a valid MFA device
B. Whether the user's password has expired or needs reset
EXPERT RATIONALE: If an account is enabled but the user cannot sign in, the most
common next check is whether the password has expired or needs to be reset, as this is
a frequent cause of sign-in failure.
3. You need to assign an Azure role to allow a user to manage virtual
machines but not networking. Which built-in role should you assign?
A. Contributor
B. Owner
C. Virtual Machine Contributor
D. Network Contributor
E. Reader
C. Virtual Machine Contributor
EXPERT RATIONALE: The Virtual Machine Contributor role grants permissions to
manage virtual machines without granting access to the virtual networks or storage
accounts they are connected to.
4. An organization wants to enforce that all Azure resources must have a
specific tag applied at creation. What should you use?
A. Azure Blueprints
B. Azure Policy
C. Azure Monitor
D. Azure Advisor
,E. Management Groups
B. Azure Policy
EXPERT RATIONALE: Azure Policy can enforce rules at resource creation time, including
requiring specific tags. A "deny" or "append" policy effect can be used to ensure
compliance.
5. You need to ensure that a resource group and all its resources cannot be
deleted accidentally. What should you apply?
A. Azure Policy
B. RBAC Owner role
C. Resource lock — Delete lock
D. Resource lock — Read-only lock
E. Azure Blueprint
C. Resource lock — Delete lock
EXPERT RATIONALE: A Delete lock prevents the resource group and its resources from
being deleted, while still allowing read and modify operations.
6. You are configuring Azure AD Multi-Factor Authentication. Which
authentication methods are supported? (Choose the best single answer)
A. SMS only
B. Authenticator app, SMS, phone call, and hardware tokens
C. Email and SMS only
D. Hardware tokens only
E. Authenticator app only
B. Authenticator app, SMS, phone call, and hardware tokens
, EXPERT RATIONALE: Azure MFA supports multiple verification methods including the
Microsoft Authenticator app, SMS text messages, phone calls, and OATH hardware
tokens.
7. You need to deploy multiple Azure resources consistently across
environments using a template. What should you use?
A. Azure Policy
B. Azure Resource Manager (ARM) templates
C. Azure Advisor
D. Azure Monitor
E. Azure Cost Management
B. Azure Resource Manager (ARM) templates
EXPERT RATIONALE: ARM templates allow you to define and deploy Azure infrastructure
as code, ensuring consistent deployments across environments.
8. You have a virtual network (VNet) with address space 10.0.0.0/16. You need
to create a subnet that supports at least 500 hosts. Which subnet mask
should you use?
A. /28
B. /27
C. /24
D. /29
E. /26
C. /24
EXPERT RATIONALE: A /24 subnet provides 254 usable host addresses. A /23 provides
510, but among the options given, /24 is the most appropriate that meets the 500-host
QUESTIONS AND ANSWERS | MICROSOFT
AZURE ADMINISTRATOR | VERIFIED
MULTIPLE CHOICE EXAM GUIDE | 100%
ACCURATE SOLUTIONS
• This AZ-104 Renewal Exam Guide contains 200 carefully curated, verified multiple-
choice questions covering all domains tested in the Microsoft Azure Administrator
certification exam — ideal for focused, exam-ready preparation.
• Study by attempting each question independently before checking the highlighted
correct answer and EXPERT RATIONALE below it — this active recall method
maximizes retention and builds real exam confidence.
1. You need to create a new Azure subscription. Which of the following is
required?
A. An Azure Active Directory tenant
B. A valid credit card or payment method
C. A Microsoft account or work/school account
D. An existing Azure resource group
E. A dedicated Azure region selection
C. A Microsoft account or work/school account
EXPERT RATIONALE: To create an Azure subscription, you need a Microsoft account or a
work/school account (Azure AD account). This is the fundamental identity requirement to
access and manage Azure services.
2. You are managing Azure AD users. A user reports they cannot sign in. You
check and the user account is enabled. What should you check next?
A. Whether the user has a valid Azure subscription
B. Whether the user's password has expired or needs reset
,C. Whether the resource group the user belongs to is locked
D. Whether the user's virtual machine is running
E. Whether the user has a valid MFA device
B. Whether the user's password has expired or needs reset
EXPERT RATIONALE: If an account is enabled but the user cannot sign in, the most
common next check is whether the password has expired or needs to be reset, as this is
a frequent cause of sign-in failure.
3. You need to assign an Azure role to allow a user to manage virtual
machines but not networking. Which built-in role should you assign?
A. Contributor
B. Owner
C. Virtual Machine Contributor
D. Network Contributor
E. Reader
C. Virtual Machine Contributor
EXPERT RATIONALE: The Virtual Machine Contributor role grants permissions to
manage virtual machines without granting access to the virtual networks or storage
accounts they are connected to.
4. An organization wants to enforce that all Azure resources must have a
specific tag applied at creation. What should you use?
A. Azure Blueprints
B. Azure Policy
C. Azure Monitor
D. Azure Advisor
,E. Management Groups
B. Azure Policy
EXPERT RATIONALE: Azure Policy can enforce rules at resource creation time, including
requiring specific tags. A "deny" or "append" policy effect can be used to ensure
compliance.
5. You need to ensure that a resource group and all its resources cannot be
deleted accidentally. What should you apply?
A. Azure Policy
B. RBAC Owner role
C. Resource lock — Delete lock
D. Resource lock — Read-only lock
E. Azure Blueprint
C. Resource lock — Delete lock
EXPERT RATIONALE: A Delete lock prevents the resource group and its resources from
being deleted, while still allowing read and modify operations.
6. You are configuring Azure AD Multi-Factor Authentication. Which
authentication methods are supported? (Choose the best single answer)
A. SMS only
B. Authenticator app, SMS, phone call, and hardware tokens
C. Email and SMS only
D. Hardware tokens only
E. Authenticator app only
B. Authenticator app, SMS, phone call, and hardware tokens
, EXPERT RATIONALE: Azure MFA supports multiple verification methods including the
Microsoft Authenticator app, SMS text messages, phone calls, and OATH hardware
tokens.
7. You need to deploy multiple Azure resources consistently across
environments using a template. What should you use?
A. Azure Policy
B. Azure Resource Manager (ARM) templates
C. Azure Advisor
D. Azure Monitor
E. Azure Cost Management
B. Azure Resource Manager (ARM) templates
EXPERT RATIONALE: ARM templates allow you to define and deploy Azure infrastructure
as code, ensuring consistent deployments across environments.
8. You have a virtual network (VNet) with address space 10.0.0.0/16. You need
to create a subnet that supports at least 500 hosts. Which subnet mask
should you use?
A. /28
B. /27
C. /24
D. /29
E. /26
C. /24
EXPERT RATIONALE: A /24 subnet provides 254 usable host addresses. A /23 provides
510, but among the options given, /24 is the most appropriate that meets the 500-host
