Do I need the AZ-104 certification to get an Azure administrator job?

It is not a legal or formal requirement, but many job descriptions ask for it because it maps directly to the administrator role. The certification proves you have covered identity, storage, compute, networking and monitoring; the interview then checks whether you can apply that knowledge. Pair the certification with hands-on lab work you can describe step by step.

How should I answer scenario-based Azure interview questions?

State the requirement back in one line, name the service or setting you would use, explain why you chose it over the obvious alternative, and mention one risk or limit. For example: a private endpoint rather than a service endpoint because on-premises users need access, with a private DNS zone so the name resolves correctly. Interviewers reward the trade-off more than the definition.

Which Azure regions in India support availability zones?

According to Microsoft's Azure regions list, Central India in Pune and India South Central in Hyderabad each have three availability zones. South India in Chennai and West India in Mumbai do not. Zone-redundant designs and zone-redundant storage in India therefore use Central India or India South Central, with fault-domain spreading as the fallback elsewhere.

Is AZ-900 needed before AZ-104?

No. Microsoft does not list AZ-900 as a prerequisite for the Azure Administrator Associate certification. It is a useful first step if you are new to cloud concepts, because it covers the vocabulary that AZ-104 assumes. If you already work with servers, networks or virtualisation, you can usually start directly with AZ-104 preparation.

How do I get hands-on Azure practice without a large bill?

Create a budget with alerts before you deploy anything, use small VM sizes, deallocate VMs when you finish, and delete each lab resource group the same day. Build labs as Bicep files so you can redeploy them in minutes instead of leaving them running. Check Microsoft's current free account and student offers on the Azure website for any credits available to you.

Azure Administrator Interview Questions (with Answers)

Azure administrator interviews are mostly scenarios: a user cannot do something, a VM cannot reach something, or the bill has jumped. Interviewers want to hear how you reason across identity, storage, compute, networking, monitoring and cost, the same areas the AZ-104 exam measures. Below are 20 scenario questions with model answers, checked against Microsoft Learn in October 2026.

At a glance

Area	Questions	AZ-104 weight (skills as of 17 April 2026)
Identity and governance	1 to 5	20 to 25%
Storage	6 to 9	15 to 20%
Compute	10 to 13	20 to 25%
Networking	14 to 17	15 to 20%
Monitoring, backup and cost	18 to 20	10 to 15%, cost sits under governance

Identity and governance

1. A developer must restart VMs in one resource group, and nothing else. What do you assign?

Grant least privilege at the narrowest scope; roles assigned higher up are inherited by everything below. The built-in Virtual Machine Contributor role at that resource group works, but it also allows creating and deleting VMs. If that is too broad, create a custom role with only Microsoft.Compute/virtualMachines/read, start/action and restart/action. Assign it to a group, not a person, so access survives team changes.

2. A Global Administrator says they cannot see any subscriptions. Why?

Microsoft Entra roles and Azure roles are separate systems. Global Administrator manages the directory and Microsoft 365, but by default has no access to Azure resources. Microsoft's roles comparison page explains the fix: turn on Access management for Azure resources, which grants User Access Administrator on all subscriptions in the tenant. Use it to repair access, then switch it off again.

3. A Contributor cannot give a colleague access to a resource group. Is something broken?

No. Contributor can manage every resource but cannot assign roles. Owner, User Access Administrator and Role Based Access Control Administrator can.

4. The company wants every resource to stay in Indian regions. How do you enforce it?

Use Azure Policy, not RBAC. RBAC decides who can act; Policy decides whether the resulting resource is compliant, whoever creates it. Assign the built-in Allowed locations policy at a management group or subscription, listing the Indian regions you use. Start with the audit effect to see what would break, then switch to deny. Existing non-compliant resources are reported, not deleted; new or updated ones are blocked.

5. How do you stop anyone deleting the production resource group by accident?

Apply a CanNotDelete lock (shown as Delete in the portal). Locks override user permissions, so even an Owner must remove the lock before deleting, and child resources inherit it. A Delete lock on any resource also blocks deletion of its whole resource group. A ReadOnly lock is stricter than its name suggests: Microsoft compares it to restricting everyone to Reader permissions, which can break routine operations, so test before applying it.

Storage

6. Which redundancy suits invoice files that must survive a zone outage in Pune and a regional disaster?

Central India (Pune) has three availability zones and is paired with South India (Chennai). Per Azure Storage redundancy, ZRS keeps copies across zones in one region, GRS copies data asynchronously to the paired region, and GZRS does both. Choose GZRS, or RA-GZRS if applications must read from the secondary without waiting for a failover. Two traps: the archive tier is not supported on ZRS or GZRS accounts, and redundancy protects against hardware failure, not against deletion or overwrites.

7. An external auditor needs read access to one container for seven days.

If the auditor can sign in as a guest, assign Storage Blob Data Reader on just that container. If you must use a shared access signature, prefer a user delegation SAS, signed with Microsoft Entra credentials rather than the account key, which is what Microsoft recommends. Grant read and list only, HTTPS only, expiring in seven days. Know the revocation detail: stored access policies are not supported for user delegation SAS; you revoke by revoking the user delegation keys. Never share account keys.

8. Logs are read for 30 days, then rarely, and must be kept for a year. What do you configure?

A lifecycle management rule, for example: move to cool after 30 days, to archive after 120 days, delete after 365. Respect the minimums in access tiers for blob data: 30 days in cool, 90 in cold and 180 in archive, or you pay a prorated early deletion charge. Archive is offline: a blob must be rehydrated before reading, which can take up to 15 hours, and lifecycle policies cannot rehydrate it for you.

9. Someone deleted important blobs. Can you get them back?

Only if protection was switched on beforehand: soft delete for blobs and containers, and blob versioning for overwritten data. Redundancy will not help, because deletes are applied to every copy. For Azure Files, the equivalents are share soft delete and snapshots. Enable data protection when you create the account, not after the incident.

Compute

10. Availability set or availability zones?

An availability set spreads VMs across up to three fault domains and 20 update domains; two or more VMs meet the 99.95% SLA, at no extra cost. Availability zones are physically separate datacentres with independent power, cooling and networking, and instances spread across zones qualify for a 99.99% SLA. You cannot combine both for the same VM, and Microsoft now recommends Virtual Machine Scale Sets with Flexible orchestration. In India, zones exist only in some regions:

Region	Location	Availability zones	Paired region
Central India	Pune	3	South India
India South Central	Hyderabad	3	Central India
South India	Chennai	None	Central India
West India	Mumbai	None	South India

So a zone-redundant design in India means Central India or India South Central, according to the Azure regions list. In Chennai or Mumbai you fall back to fault-domain spreading.

11. How do you deploy the same environment for dev, test and production without clicking?

Use ARM templates or Bicep files with a parameter per environment, keep them in Git, and preview every change with what-if before deploying.

New-AzResourceGroupDeployment -ResourceGroupName "rg-app-test" `
  -TemplateFile "./main.bicep" `
  -TemplateParameterObject @{ environment = "test" } `
  -WhatIf

Deploying a .bicep file from Azure PowerShell needs the Bicep CLI installed.

12. The web tier must scale out at peak hours and back in at night.

Run it as a Virtual Machine Scale Set behind a load balancer, with autoscale rules on CPU or a schedule. Set schedules in India Standard Time and cap the maximum instance count so a runaway rule cannot multiply your bill.

13. Developers shut down VMs from Windows every evening, but the bill has not dropped.

Shutting down inside the guest OS leaves the VM Stopped, which still holds the hardware and is billed for compute. Only Stopped (deallocated), from the portal, CLI, PowerShell or a schedule, releases the hardware and stops compute charges, as VM states and billing explains. Disks and some networking, such as static public IPs, keep charging either way. Fix it with an auto-shutdown schedule or a runbook that deallocates, set in India Standard Time.

Networking

14. VNet A is peered with B, and B with C. Can A reach C?

No. Virtual network peering is non-transitive. Options: peer A and C directly; build hub and spoke with Azure Firewall or a network virtual appliance in the hub, user-defined routes in the spokes and forwarded traffic allowed; or use Azure Virtual WAN, which provides spoke-to-spoke transit.

15. The subnet NSG denies TCP 3389 at priority 200 and allows it at 300. The NIC NSG allows 3389. Does RDP work?

No. Rules are processed in priority order from 100 to 4096, lower numbers first, and processing stops at the first match, so the deny at 200 wins. Per how NSGs filter traffic, inbound traffic is checked by the subnet NSG first and then the NIC NSG, and both must allow it. The better answer goes further: do not expose RDP or SSH to the internet at all; use Azure Bastion. Diagnose with effective security rules and Network Watcher's IP flow verify.

16. App servers must reach Azure SQL privately, including from the office over VPN.

Use a private endpoint: a network interface with a private IP in your VNet, mapped to that specific server, and reachable from on-premises over VPN or ExpressRoute. It needs a private DNS zone so the server name resolves to the private IP; forgetting DNS is the most common mistake. Then disable public access. A service endpoint is free and simpler, but the service keeps its public IP, it applies to the whole service type, and it is not reachable from on-premises.

17. A VM in a newly created VNet cannot reach the internet or Windows Update.

This is the default outbound access change. For API versions released after 31 March 2026, new virtual networks default to private subnets, so VMs get no automatic outbound IP. Add an explicit method: a NAT gateway (Microsoft's recommendation), a public IP, load balancer outbound rules, or a route through Azure Firewall. Existing VNets are not changed.

Monitoring, backup and cost

18. Alert the team when a VM stops reporting.

Send the VM's data to a Log Analytics workspace using Azure Monitor Agent, then create a log search alert with an action group for email, SMS or automation. Use alert processing rules to suppress alerts during planned maintenance.

Heartbeat
| summarize LastBeat = max(TimeGenerated) by Computer
| where LastBeat < ago(15m)

For CPU or disk thresholds, a metric alert is simpler and faster than a log query.

19. An attacker with admin rights deleted VM backups. What protects you?

Azure Backup soft delete keeps deleted backup data for 14 days by default, extendable up to 180 days, and the extra 14 days cost nothing. Microsoft has made soft delete secure by default, permanently on for newly created vaults where that is available. Undelete the item, then restore. Add immutability and separate permissions for backup administrators. AZ-104 expects you to know both Recovery Services vaults and Backup vaults.

20. The monthly bill jumped. What do you do this week, and what stops it happening again?

This week: open Cost analysis grouped by resource and tag; look for new or resized resources, VMs stopped but not deallocated, unattached disks and idle public IPs; check Azure Advisor. To prevent a repeat, create budgets with alerts, but note that budgets notify, they do not stop resources, and they are evaluated every 24 hours. At subscription or resource group scope a budget can call an action group that runs automation to stop VMs. Tag resources with an owner, and consider reservations or savings plans for steady workloads.

Preparing for Azure administrator interviews in India

Practise in your own subscription with a budget alert set first, and delete lab resources the same day. Be ready for a hands-on round: build a VNet with two subnets and an NSG, reach a VM through Bastion, assign a role at resource group scope and write one KQL query.

If you are new to Azure, start with our AZ-900 guide for India. The AZ-104 exam guide for India covers the certification itself, and cloud careers in India shows where the administrator role leads.

How CertTulen Academy can help

Our Azure Administrator Associate (AZ-104) course is built around scenarios like these, with an MCT running live labs on identity, networking, storage, backup and cost. It includes an exam voucher, mock practice tests and lab access; see the course page for details. Classes are live and online, and we also run private batches for IT teams. Contact us for a batch that suits your time zone, or WhatsApp +91 93618 83583.