ExamFinch.com My Study

Cheat sheet

Azure AZ-104 Cheat Sheet

Practice this exam

Identity + Governance

  • 20-25% of exam
  • Entra ID RBAC Policy Cost Governance Picker

Storage

  • 15-20% of exam
  • Storage Access Blob + Files Redundancy SAS vs Key

Compute

  • 20-25% of exam
  • VMs Containers App Service Compute Picker

Virtual Networking

  • 15-20% of exam
  • VNet NSG Private Access Load Balancing

Monitor + Maintain

  • 10-15% of exam
  • Azure Monitor Alerts Backup Recovery Picker

Quick Facts

  • Exam AZ-104
  • Credential Azure Administrator
  • Pass 700+
  • Time 100 min assessment
  • Level Associate
  • Renewal Annual assessment
  • Core Operate Azure

Scope Stack ID

  • Management group, subscription, group, resource.
  • MG Subscription RG Resource

Entra ID vs RBAC ID

Entra ID

  • Authentication
  • Users/groups

RBAC

  • Authorization
  • Azure resources
  • Login vs permissions

Governance Picker ID

  • Need sign-in control → Entra ID
  • Need resource permissions → RBAC
  • Need deny standards → Policy
  • Need no delete → Lock
  • Need cost grouping → Tags
  • Need spend alert → Budget
  • Need subscription hierarchy → Management groups
  • Need recommendations → Advisor

Entra ID ID

  • Tenant Identity boundary
  • User Person identity
  • Group Access collection
  • Guest External user
  • SSPR Password self-service
  • MFA Extra sign-in proof
  • Conditional Access Signal-based rules
  • PIM Just-in-time roles

Policy vs Lock ID

Policy

  • Evaluate rules
  • Deny/audit/remediate

Lock

  • Prevent changes
  • Delete/read-only
  • Standard vs protection

RBAC + Governance ID

  • Owner Full access
  • Contributor Manage, no access
  • Reader View only
  • User Access Admin Assign roles
  • Management group Subscription hierarchy
  • Policy Enforce rules
  • Initiative Policy bundle
  • Lock Prevent changes

Cost + Tags ID

  • Tags Metadata labels
  • Budget Spend threshold
  • Cost alert Spend notification
  • Advisor Optimization recommendations
  • Resource group Lifecycle container
  • Subscription Billing boundary
  • Move Check resource support
  • Template export ARM baseline

Storage Redundancy ST

  • L local, Z zones, G geo.
  • LRS ZRS GRS GZRS

SAS vs Key ST

SAS

  • Scoped token
  • Time-limited

Key

  • Account secret
  • Broad access
  • Delegate vs master

Storage Access ST

  • Access key Account secret
  • SAS Scoped delegated access
  • Stored policy Revocable SAS control
  • Firewall Network allowlist
  • Private endpoint Private Link IP
  • Service endpoint Subnet service route
  • Azure Files auth Identity-based SMB
  • Encryption Data protection

Blob + Files ST

  • Blob Object storage
  • Container Blob namespace
  • File share SMB/NFS storage
  • Hot tier Frequent access
  • Cool tier Infrequent access
  • Archive tier Offline cheapest
  • Soft delete Recover deleted data
  • Lifecycle Automated tiering

Redundancy + Tools ST

  • LRS One datacenter
  • ZRS Zone copies
  • GRS Region pair async
  • GZRS Zones plus region
  • AzCopy Command transfer
  • Storage Explorer Desktop management
  • Object replication Blob copy policy
  • Snapshot Point-in-time copy

Compute Picker CO

  • Need OS control → VM
  • Need identical VM scale → VMSS
  • Need simple container → ACI
  • Need app-scale containers → Container Apps
  • Need managed web app → App Service
  • Need image storage → ACR
  • Need IaC deployment → Bicep
  • Need staging swap → Slots

Virtual Machines CO

  • VM size CPU/memory profile
  • Managed disk Azure-managed block
  • Availability set Fault/update domains
  • Availability zone Datacenter isolation
  • VMSS Identical VM scale
  • Encryption at host Host-level encryption
  • Bicep Declarative IaC
  • ARM template JSON IaC

Platform Compute CO

  • ACR Container registry
  • ACI Single container run
  • Container Apps Serverless containers
  • App Service Managed web apps
  • App Service Plan Compute hosting plan
  • Deployment slot Swap staging
  • Custom domain DNS mapping
  • TLS cert HTTPS binding

NSG vs ASG NE

NSG

  • Traffic rules
  • Subnet/NIC applied

ASG

  • VM grouping
  • Rule target
  • Filter vs group

VNet + Routing NE

  • VNet Private network
  • Subnet Address segment
  • Peering VNet-to-VNet link
  • UDR Custom route
  • Next hop Route target
  • Public IP Internet address
  • NAT Gateway Outbound SNAT
  • Bastion Browser RDP/SSH

LB vs App Gateway NE

Load Balancer

  • Layer 4
  • TCP/UDP

App Gateway

  • Layer 7
  • HTTP routing
  • Transport vs web

Network Security NE

  • NSG Subnet/NIC filtering
  • ASG App security grouping
  • Effective rules Merged NSG view
  • Private endpoint Private service IP
  • Service endpoint Service route extension
  • Azure DNS Public zones
  • Private DNS Private resolution
  • VPN Gateway Encrypted tunnel

Load Balancing NE

  • Load Balancer Layer 4 distribution
  • App Gateway Layer 7 routing
  • Backend pool Target members
  • Health probe Availability check
  • Rule Frontend to backend
  • Inbound NAT Port forwarding
  • Traffic Manager DNS-based routing
  • Front Door Global web entry

Monitor Flow MO

  • Collect, query, alert, act.
  • Metrics Logs Alerts Actions

Monitor vs Service Health MO

Monitor

  • Your resources
  • Metrics/logs

Service Health

  • Azure incidents
  • Provider events
  • Workload vs platform

Recovery Picker MO

  • Need VM backup → Recovery vault
  • Need backup schedule → Backup policy
  • Need restore file → Recovery point
  • Need DR replication → ASR
  • Need metrics alert → Alert rule
  • Need log query → KQL

Monitoring MO

  • Azure Monitor Metrics and logs
  • Metric Numeric time series
  • Log Analytics KQL workspace
  • Diagnostic setting Send platform logs
  • Alert rule Condition trigger
  • Action group Notification target
  • Insights Curated monitoring
  • Network Watcher Network diagnostics

Backup + Recovery MO

  • Recovery vault Backup/ASR container
  • Backup vault Newer backup container
  • Backup policy Schedule and retention
  • Restore point Recoverable snapshot
  • ASR Replication/failover
  • Failover Switch region
  • Backup report Protection visibility
  • Soft delete Backup protection

Common Traps

RBAC Inheritance

  • Child scopes inherit ≠ Deny can override

Locks

  • Override RBAC actions ≠ Not data protection

Private Endpoint

  • Private IP access ≠ Needs DNS alignment

SAS Revocation

  • Stored policy helps ≠ Ad hoc expires only

VM Move

  • Not always supported ≠ Validate before move

Alert Routing

  • Rule detects ≠ Action group notifies

Last Minute

  • 1. Pass score is 700+
  • 2. Outline dated April 17, 2026
  • 3. Entra authenticates; RBAC authorizes
  • 4. Policy enforces; locks protect
  • 5. SAS is scoped access
  • 6. Private endpoint needs DNS
  • 7. LB is Layer 4
  • 8. App Gateway is Layer 7
  • 9. Monitor queries your telemetry
  • 10. ASR handles disaster recovery

Azure AZ-104

  • Practice Questions 200 questions Study Guide 75 topics Cheat Sheet 104 facts Flashcards 50 cards Videos 4 videos Blogs 5 blogs Free CE Podcast