[{"data":1,"prerenderedAt":318},["ShallowReactive",2],{"navigation":3,"/blog/az-104-common-traps":48,"/blog/az-104-common-traps-surround":311},[4,23],{"title":5,"path":6,"stem":7,"children":8,"icon":22},"Getting Started","/docs/getting-started","1.docs/1.getting-started/1.index",[9,12,17],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Installation","/docs/getting-started/installation","1.docs/1.getting-started/2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Usage","/docs/getting-started/usage","1.docs/1.getting-started/3.usage","i-lucide-sliders",false,{"title":24,"path":25,"stem":26,"children":27,"page":22},"Essentials","/docs/essentials","1.docs/2.essentials",[28,33,38,43],{"title":29,"path":30,"stem":31,"icon":32},"Markdown Syntax","/docs/essentials/markdown-syntax","1.docs/2.essentials/1.markdown-syntax","i-lucide-heading-1",{"title":34,"path":35,"stem":36,"icon":37},"Code Blocks","/docs/essentials/code-blocks","1.docs/2.essentials/2.code-blocks","i-lucide-code-xml",{"title":39,"path":40,"stem":41,"icon":42},"Prose Components","/docs/essentials/prose-components","1.docs/2.essentials/3.prose-components","i-lucide-component",{"title":44,"path":45,"stem":46,"icon":47},"Images and Embeds","/docs/essentials/images-embeds","1.docs/2.essentials/4.images-embeds","i-lucide-image",{"id":49,"title":50,"authors":51,"badge":57,"body":59,"date":300,"description":301,"draft":22,"extension":302,"image":303,"meta":305,"navigation":306,"path":307,"seo":308,"stem":309,"__hash__":310},"posts/3.blog/9.az-104-common-traps.md","AZ-104: 10 Question Traps That Catch Even Experienced Azure Admins",[52],{"name":53,"to":54,"avatar":55},"Quizify Team","/blog",{"src":56},"https://i.pravatar.cc/128?u=quizify",{"label":58},"Azure Cert Prep",{"type":60,"value":61,"toc":284},"minimark",[62,67,76,79,83,95,99,110,114,121,125,153,160,164,167,171,178,182,189,193,223,226,230,256,263,267,273,277],[63,64,66],"h2",{"id":65},"why-experienced-admins-fail-az-104","Why experienced admins fail AZ-104",[68,69,70,71,75],"p",{},"The AZ-104 is unusual among cloud certifications: it punishes people with real production Azure experience almost as often as it punishes pure beginners. The reason is that Microsoft has strong opinions about ",[72,73,74],"em",{},"the way"," you should solve a problem in Azure, and those opinions don't always match what you'd actually do in a production environment under cost or time pressure.",[68,77,78],{},"Here are the 10 most common traps. If you can spot all of them in a question, your score jumps measurably.",[63,80,82],{"id":81},"_1-azure-ad-vs-entra-id","1. Azure AD vs. Entra ID",[68,84,85,86,90,91,94],{},"If the question mentions ",[87,88,89],"strong",{},"Azure AD",", treat it as a legacy clue that the question or distractor is stale. Microsoft renamed Azure AD to ",[87,92,93],{},"Microsoft Entra ID"," in mid-2023, and current exam questions use the new name. Answer choices that still say \"Azure AD\" are often the wrong answer because they reference deprecated naming or features.",[63,96,98],{"id":97},"_2-rbac-scope-is-hierarchical-and-additive","2. RBAC scope is hierarchical and additive",[68,100,101,102,105,106,109],{},"Role assignments inherit downward (management group → subscription → resource group → resource) and are ",[87,103,104],{},"additive",". There is no way to \"subtract\" a permission lower in the tree — if Bob is granted Contributor at the subscription, you cannot demote him to Reader on one specific resource group. The trap answer always involves \"remove\" or \"deny at the lower scope\" — you actually need an explicit ",[87,107,108],{},"Deny assignment"," for that, which is rare and Azure-managed only.",[63,111,113],{"id":112},"_3-nsg-rules-lower-priority-number-wins","3. NSG rules: lower priority number wins",[68,115,116,117,120],{},"Network Security Group rules are evaluated by ",[87,118,119],{},"priority number ascending",", and the first match wins. Priority 100 beats priority 200. The trap is that admins instinctively think \"higher number = more important\" — Microsoft's evaluation order is the opposite.",[63,122,124],{"id":123},"_4-storage-account-replication-zrs-vs-grs","4. Storage account replication: ZRS vs. GRS",[126,127,128,135,141,147],"ul",{},[129,130,131,134],"li",{},[87,132,133],{},"LRS"," — 3 copies in one data center.",[129,136,137,140],{},[87,138,139],{},"ZRS"," — 3 copies across availability zones in one region.",[129,142,143,146],{},[87,144,145],{},"GRS"," — 6 copies, primary region + paired region.",[129,148,149,152],{},[87,150,151],{},"GZRS"," — ZRS + secondary region.",[68,154,155,156,159],{},"The trap: questions about ",[72,157,158],{},"zone redundancy"," often have GRS as a distractor. GRS protects against region failure, not zone failure. If the requirement is \"survive a single AZ outage,\" the answer is ZRS or GZRS, not GRS.",[63,161,163],{"id":162},"_5-public-ip-sku-must-match-the-load-balancer-sku","5. Public IP SKU must match the load balancer SKU",[68,165,166],{},"A Standard load balancer needs a Standard public IP. A Basic load balancer needs a Basic public IP. You cannot mix them. Half the load balancer questions are really testing this constraint.",[63,168,170],{"id":169},"_6-vnet-peering-is-non-transitive","6. VNet peering is non-transitive",[68,172,173,174,177],{},"A → B and B → C does ",[87,175,176],{},"not"," give A → C. You need an explicit A → C peering, or use a hub-and-spoke topology with a virtual network appliance / Azure Firewall in the hub. The trap is questions that show three VNets and ask \"can A talk to C\" — assume no unless there's an explicit peering or transit path.",[63,179,181],{"id":180},"_7-backup-retention-is-set-on-the-policy-not-the-vault","7. Backup retention is set on the policy, not the vault",[68,183,184,185,188],{},"When the question asks \"how do you change retention from 30 days to 1 year,\" the answer is to modify or create a new ",[87,186,187],{},"backup policy"," and reassign protected items. You do not change anything on the Recovery Services vault itself.",[63,190,192],{"id":191},"_8-soft-delete-is-enabled-by-default-for-some-not-all-resources","8. Soft delete is enabled by default for some, not all, resources",[126,194,195,205,214],{},[129,196,197,200,201,204],{},[87,198,199],{},"Key Vault"," — soft delete is ",[87,202,203],{},"on by default and cannot be disabled"," for new vaults.",[129,206,207,200,210,213],{},[87,208,209],{},"Storage blobs",[87,211,212],{},"off by default",", must be enabled per account.",[129,215,216,200,219,222],{},[87,217,218],{},"Recovery Services vault items",[87,220,221],{},"on by default",".",[68,224,225],{},"Questions about \"I deleted X by accident, can I recover it?\" hinge on knowing which default applies.",[63,227,229],{"id":228},"_9-azcopy-vs-azure-storage-explorer-vs-azcopy-sync","9. AzCopy vs. Azure Storage Explorer vs. azcopy sync",[126,231,232,238,244,250],{},[129,233,234,237],{},[87,235,236],{},"AzCopy"," — command-line tool, fastest for large transfers.",[129,239,240,243],{},[87,241,242],{},"Storage Explorer"," — GUI, good for browsing, slow for bulk.",[129,245,246,249],{},[87,247,248],{},"azcopy sync"," — one-way sync, mirrors source to destination.",[129,251,252,255],{},[87,253,254],{},"Azure File Sync"," — sync on-prem file servers with Azure Files.",[68,257,258,259,262],{},"If the question involves syncing on-prem ",[87,260,261],{},"file servers"," (not loose files) to Azure, the answer is Azure File Sync, not AzCopy.",[63,264,266],{"id":265},"_10-conditional-access-requires-entra-id-p1-or-higher","10. Conditional Access requires Entra ID P1 or higher",[68,268,269,270,272],{},"The Free tier of Entra ID does ",[87,271,176],{}," include Conditional Access policies. If the scenario requires CA but the customer is on the Free tier, the correct first step is to upgrade the license — not to configure a policy that won't apply.",[63,274,276],{"id":275},"how-to-drill-these-patterns","How to drill these patterns",[68,278,279,280,283],{},"Reading the list is enough to recognize the traps once. Recognizing them ",[72,281,282],{},"under timed pressure"," takes repetition with similar questions. The Quizify AZ-104 exam bank includes scenario questions that trigger each of these patterns, and the per-question explanation flags which trap the question is testing.",{"title":285,"searchDepth":286,"depth":286,"links":287},"",2,[288,289,290,291,292,293,294,295,296,297,298,299],{"id":65,"depth":286,"text":66},{"id":81,"depth":286,"text":82},{"id":97,"depth":286,"text":98},{"id":112,"depth":286,"text":113},{"id":123,"depth":286,"text":124},{"id":162,"depth":286,"text":163},{"id":169,"depth":286,"text":170},{"id":180,"depth":286,"text":181},{"id":191,"depth":286,"text":192},{"id":228,"depth":286,"text":229},{"id":265,"depth":286,"text":266},{"id":275,"depth":286,"text":276},"2026-06-05T00:00:00.000Z","The AZ-104 exam is full of questions where the *technically right* answer isn't the *Microsoft right* answer. Here are the 10 traps that catch even people with real Azure production experience — and how to recognize them under exam conditions.","md",{"src":304},"https://images.unsplash.com/photo-1573164574572-cb89e39749b4?q=80&w=1200&h=400&auto=format&fit=crop",{},true,"/blog/az-104-common-traps",{"title":50,"description":301},"3.blog/9.az-104-common-traps","1kK5D4FZJC4MaiFHDmJ-nn1UQ3UDXL7GYaCQCwtECgY",[312,317],{"title":313,"path":314,"stem":315,"description":316,"draft":22,"children":-1},"CLF-C02 Service Cheat-Sheet: The 40 AWS Services You Must Recognize on Sight","/blog/clf-c02-services-cheatsheet","3.blog/8.clf-c02-services-cheatsheet","The AWS Certified Cloud Practitioner exam loves to test service recognition under time pressure. Here are the 40 services that show up the most, grouped by category, with one-line definitions you can memorize the night before.",null,1782896922692]