CertiWho may act
- Owner manage and assign roles
- Contributor manage only
- User Access Administrator assign roles only
- Reader view only
Study guide · Flashcards & memory notes
Azure Administrator Flashcards & Memory Notes
50 recall cards for the choices AZ-104 keeps pairing: the role and the lock, the SAS and the tier, the template and the slot, the endpoint and the probe, the vault and the failover.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Identity and governance
Directory objects, roles, locks, and cost signals.
1.1What must be set before you assign an Entra license?
Usage location. The license assignment fails until that property is set.
1.2What does group-based licensing do?
It assigns the license to members of the group, including people added to the group later.
1.3What is a guest user?
An external user invited into your directory. The guest must redeem the invitation before signing in.
1.4What does self-service password reset require?
SSPR enabled for the user, plus enough registered authentication methods to satisfy the policy.
1.5How do Owner and Contributor differ?
Owner can manage resources and assign roles. Contributor can manage resources and cannot assign roles.
1.6What can User Access Administrator do?
Assign roles at the scope. That role does not create or change the resources.
1.7What is the RBAC scope order, from widest to narrowest?
Management group, subscription, resource group, resource. A child inherits an assignment from its parent.
1.8How do CanNotDelete and ReadOnly differ?
CanNotDelete blocks delete and still allows changes. ReadOnly blocks changes and delete.
1.9Do tags grant permission?
No. A tag is metadata. Use Azure Policy when a tag must exist, and RBAC when someone must be allowed to act.
1.10What is the difference between a budget and Azure Advisor?
A budget alerts when spend crosses a threshold. Advisor recommends a change that can reduce cost.
Deck 2 · Storage
Keys, SAS, redundancy, and blob recovery.
2.1Which SAS can a stored access policy revoke?
A service SAS. An account SAS cannot use a stored access policy.
2.2What signs a user delegation SAS?
A user delegation key from Microsoft Entra ID, not the storage account key.
2.3What does identity-based access for Azure Files require?
An identity source on the account, a share-level role, and file permissions. The source can be AD DS, Entra Domain Services, or Entra Kerberos.
2.4How do LRS, ZRS, and GRS differ?
LRS keeps copies in one datacenter. ZRS spreads them across zones in the region. GRS adds an asynchronous copy in the paired region.
2.5What does object replication require?
Blob versioning on the source and destination, and the change feed. Archive blobs are not copied until they are rehydrated.
2.6Name the blob access tiers.
Hot, cool, cold, and archive. Archive data is offline until you rehydrate it.
2.7How do soft delete and versioning differ?
Soft delete keeps a deleted blob for a retention period. Versioning keeps a previous version when a blob is overwritten.
2.8What does a blob lifecycle rule do?
It moves a blob to another tier or deletes it when an age condition is met.
2.9Why does a storage account have two access keys?
So you can rotate one key while clients still use the other. Prefer Entra ID or a SAS when the client supports them.
2.10What does a storage firewall control?
Which networks can use the public endpoint. A private endpoint is a separate private IP in your subnet.
Deck 3 · Compute
Templates, virtual machines, containers, and App Service.
3.1What does incremental ARM deployment do?
It creates or updates resources in the template and leaves other resources in the group alone. Complete mode deletes resources the template omits.
3.2What is Bicep?
A language that compiles to an ARM template. You deploy the compiled template with the same Azure tools.
3.3How do you move a virtual machine to another region?
Azure Resource Mover. The Move action changes the resource group or subscription and does not change the region.
3.4Can one virtual machine use an availability zone and an availability set?
No. A zone is a separate site in the region. An availability set spreads fault and update domains inside one datacenter.
3.5What does encryption at host cover?
The temporary disk and the disk caches on the host. It is not guest encryption inside the virtual machine.
3.6What is a Virtual Machine Scale Set for?
A group of VM instances you can scale by a metric, a schedule, or a manual count.
3.7How do Container Registry, Container Instances, and Container Apps differ?
Registry stores images. Container Instances runs a container group. Container Apps runs revisions that can scale, including to zero.
3.8What does an App Service plan define?
The region, operating system, SKU, and instance count shared by the apps on that plan.
3.9What is the difference between scale up and scale out?
Scale up changes the SKU. Scale out adds instances of the current SKU.
3.10What is a deployment slot?
A second copy of the app, such as staging, that you can swap with production. A slot setting stays on the slot.
Deck 4 · Virtual networking
Peering, rules, private access, DNS, and load balancers.
4.1Is virtual network peering transitive?
No. Each pair needs its own peering. Address spaces cannot overlap.
4.2What must the Azure Bastion subnet be named?
AzureBastionSubnet, and it must be /26 or larger. The virtual machine does not need a public IP.
4.3How do a service endpoint and a private endpoint differ?
A service endpoint identifies your virtual network to a public platform address. A private endpoint gives that service a private IP in your subnet.
4.4Which NSG rule wins when two rules match?
The rule with the lower priority number. A deny on either the subnet or the network interface blocks the flow.
4.5What is an application security group?
A group of network interfaces you can name in an NSG rule instead of typing IP addresses.
4.6What does a 0.0.0.0/0 route to a virtual appliance do?
It sends traffic that would have used the default route through that appliance.
4.7What is the default posture of a Standard public IP?
Closed until a network security group allows traffic. It is static and zone-redundant.
4.8How do a public and an internal load balancer differ?
A public balancer has a public frontend IP. An internal balancer has a private frontend IP.
4.9Why would a load balancer health probe fail?
The probe port or path is wrong, or the NSG does not allow traffic from the AzureLoadBalancer service tag.
4.10What is a private DNS zone for?
Name resolution inside linked virtual networks. Private endpoints need one so the service name resolves to the private IP.
Deck 5 · Monitor and recovery
Alerts, Network Watcher, backup, and Site Recovery.
5.1Where can a diagnostic setting send logs?
A Log Analytics workspace, a storage account, or an event hub.
5.2What is an action group?
The email, webhook, or automation that runs when an alert fires.
5.3What does an alert processing rule do?
It suppresses notifications or adds action groups for a time window. It does not delete the alert rule.
5.4What is IP flow verify for?
It checks whether a network security group allows or denies a specific flow.
5.5Which vault backs up an Azure virtual machine?
A Recovery Services vault in the same region. A Backup vault is used for blobs, disks, and Azure Database for PostgreSQL.
5.6Where do you create the vault for Azure-to-Azure Site Recovery?
In the target region. The Recovery Services vault there receives the replica.
5.7How do a test failover and a failover differ?
A test failover uses an isolated network and leaves production running. A failover is the real cutover.
5.8What does a backup policy set?
The schedule and how long daily, weekly, monthly, and yearly recovery points are kept.
5.9What does VM insights need?
The Azure Monitor Agent sending data to a Log Analytics workspace.
5.10What does Connection monitor do?
It tests reachability over time and reports where the path fails.
Memory notes
Groupings that make the highest-yield AZ-104 choices easier to recall.
Allow, exist, delete
- RBAC who may act
- Policy what may exist
- CanNotDelete no delete
- ReadOnly no change and no delete
Storage copies
LRS is one datacenter. ZRS is zones in the region. GRS adds the paired region asynchronously. RA-GRS lets you read that secondary.
Private path
A service endpoint identifies the virtual network. A private endpoint supplies a private IP. Bastion removes the need for a public IP on the VM.
Two vaults
Recovery Services vault: VMs, Azure Files, SQL in a VM, and Site Recovery. Backup vault: blobs, disks, and Azure Database for PostgreSQL.
Failover
Test failover is isolated and leaves production up. Planned failover is clean. Unplanned failover is for an outage and can lose data not yet replicated.
Continue the Azure Administrator study path
Test what you have learned with a timed practice exam.
Overview
Exam format, the 700 passing score, domain weights, and a study plan.
Core Notes
Reference notes for identity, storage, compute, networking, monitoring, and recovery.
Flashcards & Memory Notes
50 recall cards in five decks, plus memory notes for access, storage, compute, and recovery.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
Password Generator
Generate strong random passwords with custom length, characters, symbols, and security options.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Microsoft, Azure, and related marks are trademarks of Microsoft Corporation. Certicab is not affiliated with, endorsed by, or sponsored by Microsoft.