Azure AZ-104 cheat sheet

Azure RBAC assignments at management group, subscription, resource group, or resource scope are inherited by child scopes; effective access is the union of applicable role assignments.

Azure Policy evaluates resource properties and can deny, audit, append, or deploy remediation; it does not grant permissions, while RBAC controls who can perform actions.

Management groups sit above subscriptions and can organize many subscriptions so that RBAC and Policy assignments inherit to all child subscriptions and resource groups.

Resource locks are CanNotDelete and ReadOnly; they apply to all users regardless of RBAC role, and only users with sufficient permissions at the lock scope can remove them.

Microsoft Entra Privileged Identity Management provides eligible, time-bound role activation with optional approval, MFA, and justification instead of permanent active assignments.

Conditional Access evaluates signals such as user, group, location, device, application, and sign-in risk to grant, block, or require controls such as MFA or a compliant device.

Self-service password reset for hybrid users requires password writeback to on-premises Active Directory; administrators typically need two authentication methods registered.

Azure Policy can enforce required tags on new or updated resources, but existing untagged resources require a remediation task to be brought into compliance.

LRS keeps three copies in one datacenter in a single region; ZRS spreads three copies across availability zones; GRS stores six copies across two regions; RA-GRS adds read access to the secondary region.

Blob access tiers are Hot, Cool, Cold, and Archive; Cool has a 30-day minimum, Cold 90 days, and Archive 180 days, with early deletion charges if data leaves sooner.

Lifecycle management rules can transition blobs between tiers or delete current blobs, previous versions, and snapshots based on age, prefix, or index tags.

A stored access policy on a container or file share defines start time, expiry, and permissions for a service SAS; changing or deleting the policy revokes SAS tokens that reference it.

User delegation SAS is secured by Microsoft Entra credentials and is supported for Blob Storage; account and service SAS are secured by the storage account key unless a stored access policy is used.

When a storage account firewall is enabled, requests are denied by default unless the client IP address, virtual network service endpoint, or private endpoint is allowed; trusted Microsoft services can be exempted.

Azure Files supports SMB and NFS shares; identity-based SMB access can use on-premises AD DS, Entra Domain Services, or Entra Kerberos, while shared key and SAS authentication are also available.

Blob soft delete, blob versioning, and immutable WORM retention are separate features; soft delete retains deleted data for a configured period, and versioning keeps prior blob states.

An availability set distributes VMs across fault domains and update domains within one datacenter; availability zones distribute VMs across physically separate datacenters in a region.

A Virtual Machine Scale Set autoscale profile defines minimum, maximum, and default instance counts plus scale-out and scale-in rules, which can include a cool-down period.

Managed disk types include Standard HDD, Standard SSD, Premium SSD, Premium SSD v2, and Ultra Disk; disk caching options are None, ReadOnly, and ReadWrite.

The Custom Script Extension downloads and runs a script after VM provisioning; it is useful for post-deployment configuration and does not run again unless the extension is updated.

A proximity placement group constrains VMs or scale sets to physically close hardware to reduce latency, but it can reduce available capacity and should be used only when latency requires it.

An App Service plan defines region, operating system, pricing tier, and compute capacity; scaling the plan affects every app assigned to that plan, while scaling out adds instances.

ARM and Bicep deployments are idempotent and support incremental or complete modes; complete mode can delete resources in the target resource group that are not defined in the template.

Azure Backup uses Recovery Services vaults for IaaS VM backups and Backup vaults for newer workloads; soft delete can retain deleted backup data for a configured period.

Virtual network address spaces must not overlap when peered, and peering is nontransitive by default; spoke-to-spoke traffic needs a gateway, firewall, or user-defined route to forward it.

Azure reserves five IP addresses in each subnet: the network address, three Azure-reserved addresses, and the broadcast address, so usable addresses are total minus five.

NSG rules use priority numbers from 100 to 4096, with lower numbers evaluated first; default rules include AllowVNetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound, and outbound equivalents.

Application security groups group NICs so NSG rules can reference an application tier as source or destination instead of listing individual IP addresses.

User-defined routes support next-hop types Virtual network gateway, Virtual network, Internet, Virtual appliance, and None; the longest prefix match determines which route is used.

Azure Bastion provides browser-based RDP and SSH through the portal without public IPs on VMs and requires a dedicated subnet named AzureBastionSubnet of at least /26.

Azure Load Balancer operates at layer 4 for TCP and UDP; Application Gateway operates at layer 7 with HTTP routing, TLS termination, and optional Web Application Firewall.

A service endpoint extends the virtual network identity to a PaaS service over the Azure backbone, while a private endpoint assigns a private IP address in the subnet to the service.

Azure Monitor metrics are numeric time-series suited to near-real-time charts and alerts; logs are structured records queried with KQL in a Log Analytics workspace.

An alert rule combines a scope, condition, action group, severity, and evaluation frequency; the action group defines notifications and automated actions such as webhooks or runbooks.

A diagnostic setting routes platform logs and metrics from a resource to a Log Analytics workspace, storage account, event hub, or partner solution and is configured per resource.

Log Analytics workspaces have configurable retention for interactive queries and can archive data for longer periods; data collection rules define which data is collected and where it is sent.

Application Insights provides request, dependency, exception, and availability telemetry for applications, including smart detection and availability tests.

Azure Service Health reports Azure incidents, planned maintenance, and health advisories affecting your subscriptions; Resource Health reports the health of individual resources.

Azure Advisor provides recommendations across cost, security, reliability, operational excellence, and performance, but it does not automatically remediate every recommendation.

Network Watcher tools include IP flow verify, connection troubleshoot, packet capture, and NSG diagnostics for validating connectivity and security rule behavior.