Azure administration questions are rarely solved by recognizing a service name alone. A requirement might sound like an identity problem but actually depend on permission scope; a network symptom might have several possible causes, only one of which is an effective security rule. The useful skill is to identify the control that matches the stated requirement, then explain why the alternatives do not.

These original scenarios cover the five skill areas in Microsoft’s April 17, 2026 blueprint for Microsoft AZ-104. They are built around administrator decisions rather than memorized product descriptions. Work through each one before reading the answer. If you can select an option but cannot explain its scope, limitations, or evidence, treat the topic as unfinished.

Governance: permissions and lifecycle boundaries

Question 1 — Delegate VM operations without broad subscription control

A support team needs to start, stop, restart, and manage virtual machines in one resource group named rg-operations. It must not administer virtual machines in other resource groups or manage access assignments across the subscription. The group already exists and the support team has no other relevant assignments. What is the most appropriate starting point?

1. Assign Virtual Machine Contributor to the support group at the rg-operations scope.
2. Assign Reader to the support group at the subscription scope.
3. Assign Owner at the subscription scope so support can perform any required task.
4. Assign Storage Blob Data Contributor to the support group at the rg-operations scope.

Correct Answer: A

The requirement names both an action set and a boundary. Virtual Machine Contributor is designed to manage Azure virtual machines; assigning it at the particular resource group keeps the relevant role assignment narrower than a subscription-wide grant. It does not itself grant permission to assign Azure roles. Administrators should still check the role definition and dependencies for the specific operation, including permissions involving attached resources, instead of assuming every related resource is automatically manageable.

Reader is observation, not VM operation. Owner would allow considerably more, including managing access, and its subscription scope expands the blast radius. Storage Blob Data Contributor governs blob data access rather than VM management. The transferable reasoning is to choose the least broad role and scope that meet the workload requirement, then verify effective access rather than inferring it from the role’s friendly name.

Question 2 — Retire a test environment with a deletion lock

An old test application resides in rg-sandbox. The application owner confirms that the environment is due for retirement, but the resource group has a CanNotDelete lock. The deployment has some resources in regions other than the resource group’s metadata region. Which action accurately describes a controlled retirement?

1. Delete the resource group; its metadata region limits deletion to resources deployed in that region.
2. Move the group to another subscription; this bypasses all deletion protection.
3. Remove tags from the resource group; tags are what block its deletion.
4. Review dependencies and recoverability, obtain approval to remove the blocking lock, and then delete the resource group and its contained resources.

Correct Answer: D

The lock is a deliberate management safeguard. A group deletion can remove the resources it contains even when their deployment regions differ from the group’s metadata location, but a delete lock blocks that operation until the protection is addressed. A safe change therefore starts with an inventory of resource dependencies, recovery requirements, ownership, and authorization to change the lock. It must not assume that a development label means data is disposable or that backups exist.

Neither tags nor the location of resource-group metadata create a regional boundary for resource deletion. A subscription move is not a legitimate way to override change controls. The deeper Azure Resource Manager relationship matters here: resource groups are management and lifecycle boundaries, while deployment geography, access assignments, policies, and locks have distinct roles. The correct answer identifies the safeguard before describing the destructive action.

Storage: delegated access and recovery from mistakes

Question 3 — Share one blob briefly without giving away an account key

A contractor outside the organization’s Azure tenant needs to download one approved PDF from Azure Blob Storage during a one-hour review window. The team cannot make the blob publicly readable. An administrator with appropriate permissions can issue the access mechanism, and the contractor does not need an ongoing Azure identity. What best meets the request?

1. Send the storage account access key and revoke it after the meeting.
2. Enable anonymous read access to the entire container.
3. Generate an HTTPS, read-only, short-lived user delegation SAS scoped to that blob and transmit it securely.
4. Assign Owner at the subscription scope and remove it after one hour.

Correct Answer: C

A shared access signature can delegate a constrained set of blob operations for a limited time without revealing an account key. Where the necessary permissions and service conditions are satisfied, a user delegation SAS is secured using Microsoft Entra credentials instead of the storage account key. Configure the permission as read-only, restrict the resource, use HTTPS, bound the validity period, and protect the resulting URL as a credential. A valid SAS can be used by whoever possesses it within its authorized conditions; short lifetime and careful distribution therefore still matter.

Sending the account key exposes a much broader secret. Anonymous access undermines the explicit private-data requirement. Subscription Owner is both the wrong mechanism for a one-file handoff and an excessive permission grant. The question is not asking which account holds the file; it is asking how to delegate one data-plane action while preserving a controlled boundary.

Question 4 — Recover a blob after an accidental overwrite

A team overwrote a frequently used configuration blob with incorrect data. The storage account was already configured for blob versioning, and the previous version is still retained. The administrator needs to recover the earlier content rather than simply make future copies redundant. Which action is most direct?

1. Locate the retained previous blob version and restore or copy it to the required current state after confirming the intended version.
2. Increase storage account replication from locally redundant to geo-redundant and wait for the old bytes to return.
3. Change the blob access tier from Hot to Cool.
4. Rename the blob container and regenerate access keys.

Correct Answer: A

Blob versioning preserves previous versions when it has been enabled before the overwrite. Recovery means identifying the correct historical version, checking its properties and content, and making it available in the required current location through a supported restore or copy operation. Administrators must distinguish version recovery from soft-delete recovery; which feature protects a given failure depends on whether the object was overwritten, deleted, or subject to a different retention configuration.

Replication is valuable for durability but does not act as an undo button for a logical overwrite: changed data can replicate as well. An access tier affects storage economics and retrieval characteristics, not content history. Container renaming and key rotation do not restore old data. Storage protection must follow the actual data lifecycle: versioning and soft delete address different failure modes, and neither is a substitute for recovery verification.

Compute: scaling the infrastructure actually in use

Question 5 — Vary the number of virtual machines with demand

A business application runs on a fleet of Azure virtual machines. Its operators want to increase and decrease the number of similar VM instances automatically as load changes. The application must continue running on virtual machines rather than be rebuilt as a managed web app or container service. Which Azure capability most directly matches this requirement?

1. Azure App Service deployment slots
2. Azure DNS private zones
3. Azure Storage lifecycle management
4. Azure Virtual Machine Scale Sets with appropriate autoscale rules

Correct Answer: D

Virtual Machine Scale Sets provide a way to manage and scale a group of virtual machine instances, with autoscale configured around suitable metrics or schedule-based rules. The administrator still needs an image and instance model, capacity limits, health considerations, and monitoring. Scaling the instance count is not a substitute for making the application able to handle traffic distribution or for measuring whether the chosen rule actually protects user experience.

Deployment slots support release workflows for App Service, not the number of VM instances in this scenario. Storage lifecycle policies handle blob management, and private DNS zones resolve private names; neither controls VM fleet capacity. A realistic follow-up would inspect the metric source, cooldown and thresholds, and whether the fleet can scale back without dropping important work. Knowing when to use scale sets is more useful than simply recognizing the phrase “autoscaling.”

Networking: investigate the effective rule, not the remembered rule

Question 6 — Find a blocked flow through a VM’s network interface

An Azure VM loses outbound connectivity to a permitted application endpoint after a network security group change. Administrators see one NSG associated with the subnet and another associated with the VM’s network interface. They need to inspect the aggregate security rules affecting that NIC before changing firewall settings. Which diagnostic view is best?

1. Azure Cost Analysis for the resource group
2. Microsoft Entra sign-in logs
3. Azure Network Watcher effective security rules for the network interface
4. The virtual machine’s boot diagnostics screenshot

Correct Answer: C

The effective security rules view in Azure Network Watcher exposes the aggregated inbound and outbound security rules that apply to a NIC, including the relevant subnet and interface NSG rules and applicable administrative security rules. That makes it appropriate when the immediate question is whether an allow or deny rule explains the observed flow. It is a diagnostic starting point, not proof that every network layer is healthy. If the effective rules allow the connection, the investigation should move to route selection, name resolution, endpoint listening state, and other relevant controls.

Cost Analysis, sign-in logs, and boot diagnostics answer different questions. A login failure is not interchangeable with a packet-level restriction; a healthy guest boot does not demonstrate network reachability. The broader lesson from Azure network configuration is that subnets, NICs, NSGs, routes, DNS and private connectivity must be evaluated as separate but interacting components.

Monitoring and recovery: prove what data exists

Question 7 — Collect guest operating-system events for analysis

An operations team already sees basic Azure host metrics for its Windows and Linux VMs. It now needs to query selected Windows event logs and Linux syslog data centrally to investigate recurring service failures. No guest-log collection configuration is yet in place. Which approach addresses the missing information?

1. Rely on default host metrics; guest event logs are included automatically.
2. Configure Azure Monitor Agent and appropriate data collection rules to send the specified guest logs to a Log Analytics workspace.
3. Turn on Azure Policy auditing, which sends all guest log events to a workspace.
4. Enable a resource group deletion lock and inspect its activity history.

Correct Answer: B

Azure Monitor collects some host-level telemetry without a guest collection rule, but operating-system event data needs explicit collection. Azure Monitor Agent and data collection rules define which supported guest log sources to gather and where to send them; Log Analytics then provides a queryable destination when that is how the rule is configured. An administrator should check the rule association, agent health, selected sources, ingestion timing and costs before interpreting a blank query result as proof that no incident occurred.

Default host metrics do not stand in for Windows event or Linux syslog records. Azure Policy can assess or help enforce governance requirements but is not itself a comprehensive guest-event ingest pipeline. A delete lock protects resource management operations, not application observability. This is one of the distinctions that makes AZ-104 troubleshooting practical: first determine whether the expected evidence was collected at all.

Question 8 — Restore a protected VM to an earlier recovery point

A critical Azure VM has become unusable following an application configuration change. The team previously enabled Azure Backup protection for that VM in a Recovery Services vault, and an appropriate recovery point exists. It must restore recoverable VM state while limiting further change to the affected workload. What should it do first?

1. Inspect the existing recovery point and execute a supported Azure Backup restore workflow to the appropriate target after evaluating impact.
2. Assume availability-zone redundancy automatically rolls the VM back to a previous application state.
3. Increase the VM size and wait for a clean OS state.
4. Recreate the resource group, because its deletion history contains the VM’s disks.

Correct Answer: A

When a usable Azure Backup recovery point exists, recovery starts by confirming that the point, scope, target and restore method fit the incident. Teams should preserve evidence where required, avoid overwriting recoverable data inadvertently, and validate the restored workload rather than equating a completed job with application recovery. The Recovery Services vault and backup policy were the preventive controls; a supported restore operation uses the recovery points those controls produced.

Availability zones address infrastructure placement and resilience, not historical application state. Changing VM size does not undo a configuration mistake, while recreating a resource group is destructive and offers no restore-by-itself capability. Operationally, backup protection, restoration testing, and business recovery objectives are different decisions. They need to be understood together, but they should not be confused with compute autoscaling or network availability.

Use the wrong answers to design the next exercise

Review each missed question by writing down three items: the exact administrative requirement, the permission or service boundary, and the evidence that would confirm a safe configuration. For an RBAC miss, inspect an actual role definition and scope; for a storage miss, compare a short-lived delegated token with an account key; for monitoring, verify data arrival before building an alert. A hands-on AZ-104 lab can then turn the uncertain distinction into a repeatable operational skill.

Microsoft’s current AZ-104 outline allocates 20–25% to identity and governance, 15–20% to storage, 20–25% to compute, 15–20% to networking, and 10–15% to monitoring and maintenance. These weights help diagnose coverage gaps, but they do not justify ignoring a weak domain. The point of a practice question is not the letter in the answer; it is whether you can make the same decision safely in an unfamiliar Azure environment.