Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- Roughly 40-60 questions in about 100 minutes (check the exam page for your sitting). Scaled score out of 1,000; you need 700.
- Mixed formats: multiple choice, drag and drop, hot area, and case studies. Some sets can’t be revisited once answered. Read the instructions on each screen.
- Microsoft Learn is available in some sittings during the exam. Don’t count on it for speed.
- Domain weights: identity and governance 20-25%, compute 20-25%, storage 15-20%, networking 15-20%, monitoring and backup 10-15%.
- The exam also asks for CLI and PowerShell snippets. Recognise
azandAzcmdlet verbs rather than memorising every flag.
How to read an AZ-104 question
| The question says | Think |
|---|---|
| Least administrative effort | The built-in managed feature, not a script or custom VM |
| Prevent deletion | Resource lock |
| Enforce a rule on all new resources | Azure Policy (Deny, Modify) |
| Grant access | RBAC at the lowest scope that works, to a group |
| Without exposing keys | SAS (user delegation), Entra RBAC, managed identity |
| Private access to PaaS from on-premises | Private endpoint plus private DNS |
| Restrict to a subnet only | Service endpoint plus firewall rule |
| Minimum downtime | Slots, availability zones, load balancer, Site Recovery |
| Existing and future subscriptions | Management group |
Also: in “choose TWO” items each pick is a separate step of one solution, and answers using retired things (Basic public IP or Basic load balancer, Log Analytics agent, classic admin roles) are suspect.
RBAC and governance
| Role | Key point |
|---|---|
| Owner | Everything, including role assignment |
| Contributor | Everything except role assignment |
| Reader | Read only |
| User Access Administrator | Only manages access |
- RBAC inherits down and is additive. Only deny assignments subtract.
- Policy effects: Deny, Audit, AuditIfNotExists, Append, Modify, DeployIfNotExists, Disabled. Modify and DeployIfNotExists need a managed identity and a remediation task for existing resources.
- Locks: CanNotDelete, ReadOnly. They beat RBAC. Tags don’t inherit. Resource groups don’t nest.
- Management groups: 6 levels, one parent each. Budgets alert only. Advisor pillars: reliability, security, operational excellence, performance, cost.
- P1 features: dynamic groups, group-based licensing, SSPR writeback. P2: PIM, access reviews.
Storage
| Fact | Value |
|---|---|
| Account name | 3-24, lowercase and digits, global |
| Redundancy | LRS 3 copies, ZRS 3 zones, GRS 6 (2 regions), GZRS, RA = readable secondary |
| Tier minimums | Cool 30, Cold 90, Archive 180 days |
| Archive rehydration | Up to 15 hours standard, under 1 hour high priority (small blobs) |
| Stored access policies | 5 per container, share, queue or table |
| Soft delete default | 7 days (blobs, file shares) |
| Lifecycle rules | Run once a day |
| Object replication needs | Versioning on both, change feed on source |
- Firewall IP rules can’t use private ranges. VNet rules need a service endpoint. Trusted Microsoft services is an exception switch.
- SAS: user delegation (Entra, blob only) is the most secure. Revoke an ad hoc SAS only by rotating the key.
- Azure Files identity access: AD DS, Entra Domain Services, Entra Kerberos. RBAC at share level plus NTFS ACLs. Port 445.
- Infrastructure encryption can only be chosen at account creation.
Compute
| Fact | Value |
|---|---|
| ARM deployment modes | Incremental (default) or Complete (deletes extras) |
| Availability SLA | Single premium VM 99.9, set 99.95, zones 99.99 |
| Availability set | 3 fault domains, 20 update domains |
| Disks | Grow only. Temp disk is lost on redeploy |
| ADE | BitLocker or dm-crypt, Key Vault in same Region and subscription |
| Slots | Standard (5), Premium (20) |
| App Service backup, autoscale | Standard and above |
| ACR Premium | Geo-replication, private link |
- Bicep:
az bicep build,az bicep decompile; what-if previews a deployment. - Move a VM across Regions with Resource Mover or Site Recovery. A resource move doesn’t change the Region.
- ACI has no autoscale. Container Apps scale on KEDA rules and can scale to zero.
- App Service domain checks: CNAME for subdomain, A plus asuid TXT for the apex. Private endpoint is inbound; VNet integration is outbound and needs a delegated subnet.
Networking
| Fact | Value |
|---|---|
| Reserved addresses per subnet | 5 |
| Special subnets | GatewaySubnet, AzureBastionSubnet (/26), AzureFirewallSubnet |
| NSG priority | 100-4096, lowest first. Defaults 65000, 65001, 65500 |
| NSG evaluation | Inbound: subnet then NIC. Outbound: NIC then subnet |
| Route choice | Longest prefix, then UDR over BGP over system |
| Peering | Non-transitive, both directions, no overlap |
| Standard LB | Layer 4, zone-redundant, needs NSG allow |
| Need | Choose |
|---|---|
| TCP/UDP load balancing | Load Balancer |
| URL routing, WAF | Application Gateway |
| Global HTTP entry | Front Door |
| DNS-level failover | Traffic Manager |
| Private IP to a PaaS resource | Private endpoint |
| Free subnet-level restriction | Service endpoint |
| Admin RDP/SSH without public IP | Bastion |
- Azure DNS doesn’t sell domains. Delegate with NS records. Apex records need an alias, not CNAME.
- Network Watcher: IP flow verify (rule), Next hop (route), Connection troubleshoot (one time), Connection Monitor (continuous).
Monitoring and backup
- Platform metrics 93 days. Activity log 90 days. Resource logs need a diagnostic setting.
- AMA plus a DCR collects guest data. VM insights Map needs the Dependency agent.
- Alert rule = scope + condition + action group. Alert processing rules suppress or redirect notifications.
| Item | Recovery Services vault | Backup vault |
|---|---|---|
| Protects | VMs, Files, SQL/HANA in VMs, MARS | Blobs, disks, PostgreSQL |
- Vault default redundancy GRS, locked after items are protected. Cross Region Restore needs GRS. Soft delete 14 days. Instant restore snapshots 1-5 days, default 2.
- VM restore: new VM, restore disks, replace existing, file recovery.
- Site Recovery order: replicate -> test failover (isolated) -> clean up -> failover -> commit -> re-protect -> failback. Defaults: 24 hours retention, 4 hours app-consistent snapshots. Vault goes in the target Region.
- Backup = recover from deletion or corruption. Site Recovery = survive a regional outage.