Azure AZ-104 flashcards
Azure AZ-104 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Azure RBAC scope levels
- Permissions assigned at management group, subscription, resource group, or resource scope are inherited downward, and the union of applicable assignments determines effective access.
- Azure Policy versus RBAC
- Azure Policy evaluates and enforces resource properties and configurations, while RBAC controls who can perform actions; Policy does not grant permissions and RBAC does not enforce resource shape.
- Management group purpose
- A container above subscriptions used to organize subscriptions and apply governance, RBAC, and Policy at scale; assignments inherit to all child subscriptions and resource groups.
- Resource lock types
- CanNotDelete prevents deletion while allowing read and modify; ReadOnly prevents deletion and modification. Locks apply regardless of RBAC role, but authorized users can remove them.
- PIM eligible activation
- Privileged Identity Management provides just-in-time eligible role activation, often requiring approval, MFA, justification, and a time-bound duration instead of permanent active assignment.
- Conditional Access evaluation
- Signals such as user, group, location, device, application, and risk are evaluated to grant, block, or require controls such as MFA or a compliant device.
- SSPR hybrid requirement
- Self-service password reset for hybrid users requires password writeback to on-premises Active Directory and registered authentication methods; administrators usually need two methods.
- LRS versus ZRS
- LRS replicates three copies within one datacenter in a single region; ZRS replicates across three availability zones in the primary region, protecting against zone failure.
- RA-GRS read access
- Read-access geo-redundant storage replicates to a secondary region and provides read-only access to the secondary endpoint at any time without initiating a failover.
- Blob access tiers
- Hot is for frequent access, Cool for infrequent 30-day data, Cold for rare 90-day data, and Archive for offline data requiring rehydration; tiers affect storage and access costs.
- Lifecycle management rule
- A policy on a storage account that transitions blobs between tiers or deletes them based on conditions such as last-modified age, creation age, or prefix filters.
- Stored access policy
- A policy defined on a container or share that supplies start time, expiry, and permissions for a service SAS; changing or revoking it invalidates linked SAS tokens.
- Azure Files identity auth
- SMB access can use on-premises AD DS, Entra Domain Services, or Entra Kerberos for identity-based authentication; shared key and SAS are also possible but less granular.
- Blob soft delete
- Retains deleted blobs or snapshots for a configured retention period, allowing recovery; it is separate from blob versioning and from container soft delete.
- Storage firewall default
- When the firewall is enabled, requests are denied unless the client IP, virtual network service endpoint, or private endpoint is allowed; trusted Microsoft services can be exempted.
- Availability set fault domains
- VMs in an availability set are distributed across fault domains, which share power and network, and update domains, which share maintenance reboots within one datacenter.
- Availability zones versus sets
- Zones separate VMs across physically distinct datacenters within a region, protecting against datacenter failure; availability sets protect only against hardware and maintenance within one datacenter.
- VMSS autoscale rule
- A rule adjusts instance count based on a metric, schedule, or predictive model, with minimum and maximum bounds; scale-in and scale-out rules can differ.
- Managed disk caching
- None, ReadOnly, and ReadWrite apply to OS and data disks; ReadOnly is typical for read-heavy data disks, while ReadWrite is common for OS disks but can affect write durability.
- Custom Script Extension
- Downloads and runs a script on a VM after provisioning using a storage URI or inline command; it is useful for post-deployment configuration and runs once unless updated.
- Proximity placement group
- Constrains VMs or scale sets to physically close hardware to reduce network latency; it can limit available capacity and should be used only when latency matters.
- App Service plan
- Defines the region, operating system, pricing tier, and compute capacity for hosted apps; scaling the plan changes resources for all apps assigned to that plan.
- NSG default rules
- Built-in rules allow traffic within the virtual network and from Azure Load Balancer, deny other inbound internet traffic, and allow outbound internet; custom rules use priority.
- VNet peering transitivity
- Peering is nontransitive by default: spoke-to-spoke traffic does not flow through a hub unless a gateway, firewall, or user-defined route is configured to forward it.
- Service versus private endpoint
- A service endpoint extends the virtual network identity to a PaaS service over the Azure backbone; a private endpoint assigns a private IP address in the subnet to the service.
- UDR next hop types
- User-defined routes can specify virtual network gateway, virtual network, internet, virtual appliance, or none; the route with the longest prefix match takes precedence.
- Azure Bastion purpose
- Provides browser-based RDP and SSH to VMs through the Azure portal without public IP addresses or opening inbound management ports to the internet.
- Load Balancer versus App Gateway
- Azure Load Balancer operates at layer 4 for TCP and UDP; Application Gateway operates at layer 7 with HTTP routing, TLS termination, and optional web application firewall.
- Private DNS zone link
- A private DNS zone must be linked to each virtual network that needs to resolve its records; auto-registration can create VM records in linked virtual networks.
- Metrics versus logs
- Metrics are numeric time-series stored for near-real-time alerting and charts; logs are structured records queried with KQL in a Log Analytics workspace.
- Action group
- A reusable set of notification and action receivers, such as email, SMS, webhook, Logic App, Function, or Automation runbook, invoked by Azure Monitor alerts.
- Diagnostic setting
- Routes platform logs and metrics from a resource to a Log Analytics workspace, storage account, event hub, or partner solution; it is configured per resource.