AZ-104 exam pathFree assessment

AZ-104 Practice Tests That Find and Fix Your Weak Spots

6 practice tests, a 50-question timed simulation, and a free assessment.

Microsoft Certified: Azure Administrator Associate

Find your AZ-104 gaps in 15 minutes.

Learner actions will appear after the current account is confirmed.

Official exam objectives effective Apr 17, 2026
Sample report preview

Preview the output before you study

Take a free assessment, see the decisions costing you points, or confirm where to validate breadth next instead of browsing a generic study list.

Sample readiness result610 / 1000

Know where you stand before another full practice test.

Sample top gapVM disks and storage redundancy

Targeted repair: Fix a focused gap around disk performance, snapshots, and zone-resilient storage choices.

ReportTop gapsPass PlanTargeted repairsUnlocksPractice + Timed Exam
01Answer exam-style questions
02Work your Pass Plan
03Complete the final simulation
Try it

Answer one AZ-104 question

If you miss it, CramHQ identifies the decision you misunderstood, helps you fix it, then checks whether you can apply it in a different scenario.

CramHQ runs a stateful game backend on Azure VMs. Its data volume has tournament bursts, but measurements stay below 80,000 IOPS and 1,200 MB/s per disk. The storage team wants to tune purchased performance as seasons change without rebuilding striped sets or overbuying capacity. Which recommendation is best?

  1. Use Premium SSD managed disks for the data volume and increase the disk size until the required performance tier is reached.
  2. Use Standard SSD managed disks with Performance Plus enabled for the data volume and resize during tournaments.
  3. Use Ultra Disk managed disks for the data volume and provision IOPS and throughput for the tournament peak.
  4. Use Premium SSD v2 managed disks for the data volume and provision capacity, IOPS, and throughput independently.
Show the explanation

Premium SSD v2 supports production workloads with low latency and lets you adjust IOPS and throughput separately from disk size. The stated peaks fit within its documented per-disk limits, so it meets demand without capacity-driven overbuying.

Try it now

Free AZ-104 practice questions

Ten practice questions from the CramHQ AZ-104 bank, with answers and explanations. No signup needed. When you are ready, start the free assessment. CramHQ ranks your weak spots across the whole exam by the points they cost, and your Pass Plan starts with the costliest.

Question 1 of 10Manage Azure Identities and Governance

CramHQ deleted a build engineer's Microsoft Entra account 12 days ago during offboarding. The engineer returns to help ship a game update, and sign-in to internal build tools fails before any app permission check. The studio wants the fastest supported fix that preserves the prior identity relationship where possible. What should the administrator recommend?

  1. Restore the deleted Microsoft Entra user from Deleted users, then validate whether existing group and app relationships still meet the engineer's needs.
  2. Create a new Microsoft Entra user with the same user principal name, then add it to the previous Microsoft Entra security groups.
  3. Assign a Microsoft 365 license to the engineer's former account, then retry sign-in and app access.
  4. Assign the engineer the Reader role at the subscription scope, then have the build-tool owners reapply application permissions.
Show answer and explanation

Answer: A

A recently deleted Microsoft Entra user can be restored during the supported recovery window. Because the failure occurs before authorization, restoring the original object is the fastest supported way to recover the identity relationship.

If you picked B

Why it is tempting: The visible sign-in name and group access can look like the parts that matter most for restoring access quickly.

Why it is wrong: A newly created Microsoft Entra user is a different identity object; restore the deleted object when supported recovery is still available.

If you picked C

Why it is tempting: Licenses are often required for Microsoft 365 services, so adding one can feel like a quick access fix.

Why it is wrong: Licensing can enable service use only for an existing usable account; it does not restore a deleted identity object.

If you picked D

Why it is tempting: Role assignments and app permissions are common access fixes after a user reaches a resource or application.

Why it is wrong: Azure RBAC and application permissions are authorization controls; they do not restore a deleted Microsoft Entra sign-in identity.

Question 2 of 10Manage Azure Identities and Governance

CramHQ's claims analytics team needs an identity object for a rotating operations pod that will receive the User Administrator directory role for onboarding analysts. Membership changes must be deliberate, not attribute-driven, and the object must not create a mailbox, site, or team workspace. Which recommendation best fits the assignment?

  1. Create a Microsoft 365 role-assignable group with assigned membership, and assign the User Administrator Microsoft Entra role to the group.
  2. Create a Microsoft Entra role-assignable security group with assigned membership, and assign the User Administrator Microsoft Entra role to the group.
  3. Create a Microsoft Entra role-assignable security group with dynamic user membership, and assign the User Administrator Microsoft Entra role to the group.
  4. Create a Microsoft Entra security group with assigned membership, and assign the User Administrator Microsoft Entra role to the group.
Show answer and explanation

Answer: B

This matches the requested administrative assignment, keeps membership manually controlled, and avoids creating collaboration resources that are unnecessary for the operations pod.

If you picked A

Why it is tempting: A Microsoft 365 role-assignable group can appear suitable because it can be used for administrative role assignment.

Why it is wrong: Choose a security group when the object only needs identity and access administration and must not create collaboration resources.

If you picked C

Why it is tempting: Dynamic user membership can seem useful for a rotating pod because it automates changes.

Why it is wrong: Use assigned membership when the scenario requires deliberate membership control, and do not combine dynamic membership with a role-assignable group.

If you picked D

Why it is tempting: A standard security group avoids collaboration artifacts and can use assigned membership, so it satisfies much of the stem.

Why it is wrong: A group must be created as role-assignable before it can be assigned Microsoft Entra administrative roles.

Question 3 of 10Implement and Manage Storage

CramHQ stores regional case evidence in one Azure file share using identity-based SMB access. Legal researchers need read/write only in their region's folder; auditors need read-only across all folders. Identities are synced groups, access keys are disallowed, and administrators want least privilege without creating separate shares. Which configuration should you recommend?

  1. Assign Storage File Data SMB Share Reader to both groups at the file share, then configure Windows ACLs that grant Modify to researchers and Read to auditors.
  2. Set the default share-level permission to Storage File Data SMB Share Contributor, then configure Windows ACLs that grant Modify to researchers and Read to auditors.
  3. Assign Storage File Data SMB Share Contributor to both groups at the file share, then configure Windows ACLs that grant Modify to researchers and Read to auditors.
  4. Assign Storage File Data SMB Share Contributor to researchers and Storage File Data SMB Share Reader to auditors at the file share, then configure Windows ACLs for each folder scope.
Show answer and explanation

Answer: D

This matches the required access at both authorization layers. The outer assignments permit only the needed SMB capability for each group, and the Windows ACLs narrow researchers to their regional folders while allowing auditor read access.

If you picked A

Why it is tempting: The ACL grants Modify to researchers, so it can look like the folder rule supplies the missing write permission.

Why it is wrong: Azure Files SMB access must pass both the share-level role and the Windows ACL; the effective access cannot exceed the more restrictive layer.

If you picked B

Why it is tempting: The ACLs appear to provide the right researcher and auditor permissions inside the folder tree.

Why it is wrong: Use group-specific share-level SMB role assignments when groups need different broad capabilities, then use ACLs for folder-level narrowing.

If you picked C

Why it is tempting: The auditor ACL is read-only, so the final folder behavior can seem aligned with the requirement.

Why it is wrong: Least privilege should be applied at both layers: the share-level SMB role should not include capabilities the group does not need.

Show all 10 practice questions
Question 4 of 10Implement and Manage Storage

CramHQ stores research clips and internal lab notes in separate containers within one storage account. A partner portal must let browsers fetch selected clip URLs without sign-in or per-request tokens, but users must not list the clip set or read lab notes. Which configuration best meets the requirement?

  1. Set Allow Blob anonymous access to Enabled on the storage account; set the clip container's anonymous access level to Container; keep the notes container Private.
  2. Set Allow Blob anonymous access to Enabled on the storage account; set both containers' anonymous access level to Blob; move the notes blobs to Archive.
  3. Set Allow Blob anonymous access to Disabled on the storage account; set the clip container's anonymous access level to Blob; keep the notes container Private.
  4. Set Allow Blob anonymous access to Enabled on the storage account; set the clip container's anonymous access level to Blob; keep the notes container Private.
Show answer and explanation

Answer: D

This uses the account setting as the prerequisite and exposes only direct reads of blobs in the clip container. The Blob level does not allow anonymous listing of the container, and the notes container remains authorized-only.

If you picked A

Why it is tempting: Container access sounds related because it lets unauthenticated users reach blobs in the clip container.

Why it is wrong: Use Blob public access when anonymous users need direct blob reads but must not list the container contents.

If you picked B

Why it is tempting: Both containers use the narrower Blob level, so the choice can look controlled at first glance.

Why it is wrong: Apply anonymous access only to the container that must be public, and keep unrelated protected containers private.

If you picked C

Why it is tempting: The clip container is set to the correct Blob level and the notes container stays private, so the lower-scope settings look right.

Why it is wrong: The storage account must allow anonymous blob access before any container-level anonymous access setting can take effect.

Question 5 of 10Deploy and Manage Azure Compute Resources

CramHQ deploys the same inference platform baseline into resource groups across several subscriptions. Each run changes region, naming prefixes, and capacity limits, and engineers have been editing the template before promotion, causing drift. Which recommendation best supports consistent promotion while allowing those per-environment differences?

  1. Use one Bicep file, provide environment-specific .bicepparam files, and run the deployment from the tenant root so every subscription is reachable.
  2. Use one Bicep file, provide environment-specific .bicepparam files, and run the deployment at the resource group that each environment owns.
  3. Use one Bicep file, derive environment values from resource group tags during deployment, and run the deployment at the resource group that each environment owns.
  4. Create one Bicep file per environment, store the environment values as variables, and run each deployment at the resource group that each environment owns.
Show answer and explanation

Answer: B

This keeps the declarative artifact unchanged while supplying approved values per environment. Starting the operation at the owning resource group matches the target resources and avoids creating template copies for promotion.

If you picked A

Why it is tempting: The tenant root sounds useful when several subscriptions are involved, and the parameter-file part is correct.

Why it is wrong: Choose the deployment scope based on where the target resources are created or updated, not on the broadest place that can see subscriptions.

If you picked C

Why it is tempting: Tags are already associated with the environment, so deriving values from them can seem centralized and convenient.

Why it is wrong: Deployment runs should use the intended template or Bicep artifact with explicit reviewed inputs, such as parameter files or supplied parameter values.

If you picked D

Why it is tempting: Separate files can look easy to review because each environment has its own artifact.

Why it is wrong: Use parameters for values that vary between environments; reserve template or Bicep changes for actual differences in resource structure or logic.

Question 6 of 10Deploy and Manage Azure Compute Resources

CramHQ exports an ARM template for a production resource group and shortens one existing resource block before adding a setting required by new inference workers. The deployment must change only the intended settings while leaving current nondefault configuration and unrelated resources in the group intact. What should you recommend?

  1. Leave only the changed properties in the existing ARM template resource, deploy to the resource group in incremental mode, and verify with Azure Resource Manager what-if.
  2. Keep the shortened ARM template resource, add explicit dependsOn entries for related resources, deploy in incremental mode, and verify with Azure Resource Manager what-if.
  3. Keep the existing resource as a full ARM template declaration, add the needed property, preserve current nondefault settings, and deploy to the resource group in incremental mode after Azure Resource Manager what-if.
  4. Keep the shortened ARM template resource, add the needed property, deploy to the resource group in complete mode, and verify with Azure Resource Manager what-if.
Show answer and explanation

Answer: C

This matches documented behavior: incremental mode leaves unrelated group resources unchanged, while included resources are reapplied from the template. Keeping the full declaration avoids resetting omitted nondefault properties.

If you picked A

Why it is tempting: Incremental mode does leave resources that are not in the template unchanged, so it can sound like a narrow update mode.

Why it is wrong: For a resource included in the template, the declaration is reapplied as the desired final shape; preserve needed nondefault properties in the template.

If you picked B

Why it is tempting: dependsOn is a real ARM template control, and adding explicit dependencies can look like a safer deployment structure.

Why it is wrong: dependsOn controls creation or update order; it does not change how omitted properties in a declared resource are handled.

If you picked D

Why it is tempting: Complete mode sounds rigorous because it reconciles the resource group against the template.

Why it is wrong: Use complete mode only when resources absent from the resolved template are intended to be removed from the deployment scope.

Question 7 of 10Implement and Manage Virtual Networking

CramHQ has a lab subnet with one network security group. An existing inbound custom rule at 200 denies TCP 1433 from VirtualNetwork to DB-ASG. Simulator VMs are in SIM-ASG, and database VMs are in DB-ASG. Only simulator VMs must reach the databases on 1433, while the broad block must still apply to all other VMs. Which change should you make?

  1. Add an outbound network security group rule: source SIM-ASG, destination DB-ASG, TCP 1433, Allow, priority 100.
  2. Add an inbound network security group rule: source SIM-ASG, destination DB-ASG, TCP 1433, Allow, priority 100.
  3. Associate a new network security group to the database NICs with inbound source SIM-ASG, destination DB-ASG, TCP 1433, Allow, priority 100.
  4. Add an inbound network security group rule: source SIM-ASG, destination DB-ASG, TCP 1433, Allow, priority 300.
Show answer and explanation

Answer: B

This creates a narrow allowance that is evaluated before the existing deny rule. The simulator-to-database packets match the allow first, while other VirtualNetwork sources still match the deny at 200.

If you picked A

Why it is tempting: The rule uses the right ASGs, port, action, and priority, so it looks like a targeted exception.

Why it is wrong: Match the NSG rule direction to the blocking rule and the evaluated traffic path. An inbound destination-side deny needs an inbound exception that is evaluated before it.

If you picked C

Why it is tempting: The rule itself has the right source, destination, port, action, and priority, so the attachment point can be easy to overlook.

Why it is wrong: When both subnet and NIC NSGs apply, the traffic must be allowed by the applicable rules at each point; a deny at one point still blocks the flow.

If you picked D

Why it is tempting: The rule has the right inbound direction and the correct SIM-ASG-to-DB-ASG targeting.

Why it is wrong: For matching NSG rules, lower numeric priority values are evaluated first, and processing stops at the first match.

Question 8 of 10Implement and Manage Virtual Networking

A hub virtual network in each Azure region already connects to CramHQ datacenters. A new plant workload virtual network in the same region must reach datacenter IP ranges and hub-hosted shared services over private addresses. Network engineers want the plant network to consume the existing regional path instead of deploying another virtual network gateway. Which peering configuration should you recommend?

  1. On the hub-to-plant peering, enable Allow gateway transit; on the plant-to-hub peering, enable Use remote gateways.
  2. On the hub-to-plant peering, enable Allow gateway transit; on the plant-to-hub peering, enable Allow forwarded traffic.
  3. On the hub-to-plant peering, enable Allow forwarded traffic; on the plant-to-hub peering, enable Use remote gateways.
  4. On the plant-to-hub peering, enable Allow gateway transit; on the hub-to-plant peering, enable Use remote gateways.
Show answer and explanation

Answer: A

This assigns the existing hub path to be usable by the peer and configures the plant network to consume that remote path. The plant can also reach hub-hosted private services over the peering.

If you picked B

Why it is tempting: The hub-side gateway transit setting is correct, and forwarded traffic sounds related to routing across networks.

Why it is wrong: Use remote gateways is the plant-side setting that lets the plant VNet consume the hub gateway; Allow forwarded traffic is a separate peering control.

If you picked C

Why it is tempting: Use remote gateways is required on the plant-to-hub peering, so the answer contains one important correct setting.

Why it is wrong: The gateway-owning VNet must allow gateway transit before another peered VNet can use that gateway.

If you picked D

Why it is tempting: The answer contains the two gateway-related settings, but places them on the wrong peering directions.

Why it is wrong: The VNet with the existing gateway allows gateway transit; the VNet without the gateway uses remote gateways.

Question 9 of 10Monitor and Maintain Azure Resources

A studio operations team discovers that an automated cleanup job corrupted a large data volume on a backed-up Azure VM that still runs correctly. Since the last clean backup, engineers applied OS and service hotfixes that must remain. The team must validate the recovered data before changing production. What should you recommend?

  1. Use Replace existing disk from the last clean recovery point on the current VM, boot it, and validate the application data in place.
  2. Restore the VM from the last clean recovery point as a new VM in the production subnet, validate it, and redirect users to the new VM.
  3. Use File Recovery from the last clean recovery point, mount the recovery point on the VM, and copy the affected folders into production.
  4. Restore disks from the last clean recovery point to a staging resource group, attach the restored data disk to a test VM, and promote the validated data.
Show answer and explanation

Answer: D

Restoring disks from the selected point creates recoverable disk artifacts without replacing the running VM. The affected data can be mounted and checked first, while current OS and service changes remain intact.

If you picked A

Why it is tempting: Replacing existing disks sounds direct because it uses the last clean recovery point on the affected VM.

Why it is wrong: Use replacement only when rolling back the VM disk state is acceptable. If production must remain unchanged until validation, restore recoverable data separately.

If you picked B

Why it is tempting: A new VM can be validated separately, so it appears to satisfy the testing requirement.

Why it is wrong: Use a full VM restore when the machine state needs recovery. For a healthy VM with damaged data, restore only the needed disk data and validate it separately.

If you picked C

Why it is tempting: File Recovery is useful when only a few known files or folders must be copied back.

Why it is wrong: Use file-level recovery for selective file or folder restore. Use disk-level restore when the damaged boundary is a disk or large volume that should be mounted and validated outside production.

Question 10 of 10Monitor and Maintain Azure Resources

CramHQ protects a Windows Server VM with Azure Site Recovery. During a scheduled drill, the team wants the newest replica state that can be started immediately in Azure; the test window cannot wait for Azure to incorporate any remaining replicated changes. Application quiescence is not the validation goal. Which recovery point choice should the administrator select?

  1. Run the Azure Site Recovery test failover and select Latest processed as the recovery point.
  2. Run the Azure Site Recovery test failover and select Latest (lowest RPO) as the recovery point.
  3. Run the Azure Site Recovery test failover and select Custom, then choose the newest timestamp shown in the retention window.
  4. Run the Azure Site Recovery test failover and select Latest app-consistent as the recovery point.
Show answer and explanation

Answer: A

Latest processed uses the newest recovery point that Azure Site Recovery has already prepared. Microsoft documents it as a low-RTO choice because no time is spent processing unprocessed data before failover.

If you picked B

Why it is tempting: Latest (lowest RPO) sounds like the freshest and safest option when a scenario asks for the newest replica state.

Why it is wrong: Choose the lowest-RPO recovery point only when the scenario can tolerate the time needed to process all replicated data first.

If you picked C

Why it is tempting: A custom timestamp can feel precise and controlled, especially when the stem emphasizes newest state.

Why it is wrong: Use a custom recovery point when a specific point in time is required, not when the goal is the newest processed point with minimal delay.

If you picked D

Why it is tempting: Application-consistent recovery sounds safer because it reflects a cleaner application state.

Why it is wrong: Choose an application-consistent recovery point when application quiescence or application-level consistency is the stated goal.

CramHQ links wrong answers to the mistake behind them. Start with the free assessment, and CramHQ keeps finding your gaps as you practice and adds a repair for each to your Pass Plan.

Start the free AZ-104 assessment

Why study with CramHQ

Turn AZ-104 gaps into administrator judgment.

Start with the free AZ-104 assessment. CramHQ uses your result to rank the next step, explain the decisions that matter, and check you again.

Learner actions will appear after the current account is confirmed.

  1. A clear next step, chosen for you

    The Pass Plan ranks gaps by the points they cost and opens the top repair.

  2. Understand why an answer works

    The reasoning behind the right answer and where the alternatives break.

  3. Prove it on a retest

    A fresh question on the same decision verifies the gap is closed.

  4. Track it on your readiness map

    Strengthened areas change colour; pick the next priority from what is left.

  • Flashcards saved from your repairs
  • Optional hints when you are stuck
  • Timed simulations at exam pace
Exam syllabus

Exam-weighted coverage.

Coverage follows the published AZ-104 skill areas measured as of Apr 17, 2026, so your practice stays aligned.

Manage Azure Identities and Governance

24%

11 concepts

Implement and Manage Storage

19%

12 concepts

Deploy and Manage Azure Compute Resources

24%

15 concepts

Implement and Manage Virtual Networking

19%

12 concepts

Monitor and Maintain Azure Resources

14%

9 concepts

Official Microsoft exam changes

Microsoft exam update history

Changes recorded from official Microsoft exam sources.

Effective Apr 17, 2026Minor updateMicrosoft made minor updates across storage, compute, networking, and monitoring skills.Integrated by CramHQ

Compared with Skills measured prior to April 17, 2026

Changed

  • Azure Files and Blob Storage skills were updated.
  • Virtual machine and portal container skills were updated.
  • Virtual network and Azure Monitor skills were updated.
  • The audience profile was updated.
Updated

CramHQ completed the AZ-104 update for the changed Microsoft storage, compute, networking, monitoring, and audience-profile scope.

View official source
Effective Apr 18, 2025Minor updateMicrosoft made minor updates to Azure storage skills.Integrated by CramHQ

Compared with Skills measured prior to 2025-04-18

Changed

  • Microsoft made minor updates to Azure storage skills.
Updated

CramHQ integrated the AZ-104 update into this course.

View official source
Effective Oct 26, 2023Minor updateMicrosoft updated the audience profile and Microsoft Entra terminology.Integrated by CramHQ

Compared with Skills measured prior to 2023-10-26

Changed

  • Microsoft updated the audience profile and Microsoft Entra terminology.
Updated

CramHQ integrated the AZ-104 update into this course.

View official source
Practice and validate

Build breadth before the timed simulation.

Use separate exam-style practice quizzes to validate breadth, review explanations and your answers, use hints when stuck, and build confidence before the timed simulation, with an optional timer.

6 Practice Quizzes

01Practice quiz

AZ-104 Practice Quiz 1

Questions
50
Timer
Optional
02Practice quiz

AZ-104 Practice Quiz 2

Questions
50
Timer
Optional
03Practice quiz

AZ-104 Practice Quiz 3

Questions
50
Timer
Optional
04Practice quiz

AZ-104 Practice Quiz 4

Questions
50
Timer
Optional
05Practice quiz

AZ-104 Practice Quiz 5

Questions
50
Timer
Optional
06Practice quiz

AZ-104 Practice Quiz 6

Questions
50
Timer
Optional
Timed readiness check

Check readiness under timed conditions.

Use this after practice when you want an exam-style pacing, stamina, and breadth check.

FinalReadiness simulation
CramHQ target700 / 1000

AZ-104 Final Readiness Simulation

Questions
50
Time
100 min
Mode
Timed

Start with the free assessment; full Pass Plan access unlocks the timed exam simulation.

Question formats

Practice the formats this exam path supports.

CramHQ shows the interaction patterns available for AZ-104 from the active exam path inventory.

Single answer

Choose the best answer from exam-style options.

Multi-answer

Select every correct option when more than one applies.

Case study

Work through scenario context before answering.

Matching

Match services, tools, or concepts to the right category.

Sequencing

Sequence steps or decisions when the exam path calls for ordering.

Hotspot

Select the correct option in supported visual or row-based prompts.

Exam integrity

Original practice, aligned to public objectives.

CramHQ helps you practice the decisions behind AZ-104 without using copied or confidential exam content.

Practice contentOriginal questions

Original practice questions aligned to public exam objectives.

Coverage sourcePublic objectives

Coverage is checked against the published exam objectives.

Provider relationshipIndependent prep
Microsoft AZ-104 study guide

CramHQ is independent and is not affiliated with Microsoft.

Readiness guide

Not sure if you are ready for AZ-104?

Use the AZ-104 readiness checklist to interpret practice scores, spot gaps a score can hide, and decide whether to book the exam or keep repairing weak areas.

Read the AZ-104 readiness checklist before you book the exam
Quick answers

AZ-104 practice test questions, answered.

Do I need to sign up?

No. You can start the assessment and review your report before creating an account. Sign up when you want to save the report and continue the Pass Plan.

Is the report free?

Yes. The assessment, readiness report, and your first targeted repair are free.

Are these copied exam questions or dumps?

No. CramHQ uses original practice items designed to test the decisions and concepts behind the exam.

Is CramHQ affiliated with Microsoft?

No. CramHQ is independent and is not endorsed by Microsoft.

What do I get after the assessment?

Save your report to keep the Pass Plan, fix your first gap free, and unlock the full Pass Plan when you want every repair, practice quizzes, and timed simulation.

I have already studied a lot. Is this still worth it?

That is exactly who it is built for. CramHQ keeps tracking the last few gaps between you and a comfortable pass, the ones a raw score hides, and puts the one costing you the most points at the top of your Pass Plan.

How long do I get access?

12 months of full access from purchase, with room to come back after a break.

What is your refund policy?

Paid exam paths come with a 7-day money-back guarantee. Conditions apply; see the Refund Policy. You can also try the assessment and your first repair free before you buy. Refund Policy

More exam paths

Choose the next certification path that fits your current goal.