AZ-104: 10 Question Traps That Catch Even Experienced Azure Admins

Why experienced admins fail AZ-104

The AZ-104 is unusual among cloud certifications: it punishes people with real production Azure experience almost as often as it punishes pure beginners. The reason is that Microsoft has strong opinions about the way you should solve a problem in Azure, and those opinions don't always match what you'd actually do in a production environment under cost or time pressure.

Here are the 10 most common traps. If you can spot all of them in a question, your score jumps measurably.

1. Azure AD vs. Entra ID

If the question mentions Azure AD, treat it as a legacy clue that the question or distractor is stale. Microsoft renamed Azure AD to Microsoft Entra ID in mid-2023, and current exam questions use the new name. Answer choices that still say "Azure AD" are often the wrong answer because they reference deprecated naming or features.

2. RBAC scope is hierarchical and additive

Role assignments inherit downward (management group → subscription → resource group → resource) and are additive. There is no way to "subtract" a permission lower in the tree — if Bob is granted Contributor at the subscription, you cannot demote him to Reader on one specific resource group. The trap answer always involves "remove" or "deny at the lower scope" — you actually need an explicit Deny assignment for that, which is rare and Azure-managed only.

3. NSG rules: lower priority number wins

Network Security Group rules are evaluated by priority number ascending, and the first match wins. Priority 100 beats priority 200. The trap is that admins instinctively think "higher number = more important" — Microsoft's evaluation order is the opposite.

4. Storage account replication: ZRS vs. GRS

• LRS — 3 copies in one data center.
• ZRS — 3 copies across availability zones in one region.
• GRS — 6 copies, primary region + paired region.
• GZRS — ZRS + secondary region.

The trap: questions about zone redundancy often have GRS as a distractor. GRS protects against region failure, not zone failure. If the requirement is "survive a single AZ outage," the answer is ZRS or GZRS, not GRS.

5. Public IP SKU must match the load balancer SKU

A Standard load balancer needs a Standard public IP. A Basic load balancer needs a Basic public IP. You cannot mix them. Half the load balancer questions are really testing this constraint.

6. VNet peering is non-transitive

A → B and B → C does not give A → C. You need an explicit A → C peering, or use a hub-and-spoke topology with a virtual network appliance / Azure Firewall in the hub. The trap is questions that show three VNets and ask "can A talk to C" — assume no unless there's an explicit peering or transit path.

7. Backup retention is set on the policy, not the vault

When the question asks "how do you change retention from 30 days to 1 year," the answer is to modify or create a new backup policy and reassign protected items. You do not change anything on the Recovery Services vault itself.

8. Soft delete is enabled by default for some, not all, resources

• Key Vault — soft delete is on by default and cannot be disabled for new vaults.
• Storage blobs — soft delete is off by default, must be enabled per account.
• Recovery Services vault items — soft delete is on by default.

Questions about "I deleted X by accident, can I recover it?" hinge on knowing which default applies.

9. AzCopy vs. Azure Storage Explorer vs. azcopy sync

• AzCopy — command-line tool, fastest for large transfers.
• Storage Explorer — GUI, good for browsing, slow for bulk.
• azcopy sync — one-way sync, mirrors source to destination.
• Azure File Sync — sync on-prem file servers with Azure Files.

If the question involves syncing on-prem file servers (not loose files) to Azure, the answer is Azure File Sync, not AzCopy.

10. Conditional Access requires Entra ID P1 or higher

The Free tier of Entra ID does not include Conditional Access policies. If the scenario requires CA but the customer is on the Free tier, the correct first step is to upgrade the license — not to configure a policy that won't apply.

How to drill these patterns

Reading the list is enough to recognize the traps once. Recognizing them under timed pressure takes repetition with similar questions. The Quizify AZ-104 exam bank includes scenario questions that trigger each of these patterns, and the per-question explanation flags which trap the question is testing.