[{"data":1,"prerenderedAt":803},["ShallowReactive",2],{"navigation":3,"/blog/az-104-study-guide":48,"/blog/az-104-study-guide-surround":796},[4,23],{"title":5,"path":6,"stem":7,"children":8,"icon":22},"Getting Started","/docs/getting-started","1.docs/1.getting-started/1.index",[9,12,17],{"title":10,"path":6,"stem":7,"icon":11},"Introduction","i-lucide-house",{"title":13,"path":14,"stem":15,"icon":16},"Installation","/docs/getting-started/installation","1.docs/1.getting-started/2.installation","i-lucide-download",{"title":18,"path":19,"stem":20,"icon":21},"Usage","/docs/getting-started/usage","1.docs/1.getting-started/3.usage","i-lucide-sliders",false,{"title":24,"path":25,"stem":26,"children":27,"page":22},"Essentials","/docs/essentials","1.docs/2.essentials",[28,33,38,43],{"title":29,"path":30,"stem":31,"icon":32},"Markdown Syntax","/docs/essentials/markdown-syntax","1.docs/2.essentials/1.markdown-syntax","i-lucide-heading-1",{"title":34,"path":35,"stem":36,"icon":37},"Code Blocks","/docs/essentials/code-blocks","1.docs/2.essentials/2.code-blocks","i-lucide-code-xml",{"title":39,"path":40,"stem":41,"icon":42},"Prose Components","/docs/essentials/prose-components","1.docs/2.essentials/3.prose-components","i-lucide-component",{"title":44,"path":45,"stem":46,"icon":47},"Images and Embeds","/docs/essentials/images-embeds","1.docs/2.essentials/4.images-embeds","i-lucide-image",{"id":49,"title":50,"authors":51,"badge":57,"body":59,"date":785,"description":786,"draft":22,"extension":787,"image":788,"meta":790,"navigation":791,"path":792,"seo":793,"stem":794,"__hash__":795},"posts/3.blog/7.az-104-study-guide.md","Microsoft Azure Administrator (AZ-104) Study Guide: Every Domain, Every Skill",[52],{"name":53,"to":54,"avatar":55},"Quizify Team","/blog",{"src":56},"https://i.pravatar.cc/128?u=quizify",{"label":58},"Azure Cert Prep",{"type":60,"value":61,"toc":770},"minimark",[62,67,71,79,83,91,133,136,140,143,148,210,220,224,231,235,306,315,319,322,326,416,421,425,428,432,520,525,529,532,536,620,625,629,632,670,674,677,715,719,726,750,758,762,765],[63,64,66],"h2",{"id":65},"what-this-guide-covers","What this guide covers",[68,69,70],"p",{},"The Microsoft Certified: Azure Administrator Associate (AZ-104) is the mid-level Azure certification — the one that proves you can deploy, manage, and monitor identity, storage, compute, networking, and observability resources at a production-administrator level. It's a 100-minute exam, 40–60 questions, and the pass mark is 700 out of 1000.",[68,72,73,74,78],{},"This guide walks through the ",[75,76,77],"strong",{},"five official AZ-104 skill domains"," by their current weight, names the Azure services you must recognize cold, flags the questions that get over-tested, and calls out the legacy terminology that will trip up candidates who studied with old (AZ-100 / AZ-103-era) material.",[63,80,82],{"id":81},"a-note-on-terminology-before-you-start","A note on terminology before you start",[68,84,85,86,90],{},"Microsoft renamed several products since the previous version of the exam. Studying with old material is the single biggest cause of confusion on test day. Internalize these ",[87,88,89],"em",{},"now",":",[92,93,94,105,111,121,127],"ul",{},[95,96,97,100,101,104],"li",{},[75,98,99],{},"Microsoft Entra ID"," is the current name for what used to be called ",[75,102,103],{},"Azure Active Directory"," (Azure AD). The rename happened in 2023. You will see \"Entra ID\" in the exam, the portal, and modern docs — but old study guides still say \"Azure AD.\" They mean the same product.",[95,106,107,110],{},[75,108,109],{},"Entra ID is not Active Directory Domain Services."," Different protocols (OAuth/SAML vs Kerberos/LDAP), no OUs, no Group Policy. Don't conflate them.",[95,112,113,116,117,120],{},[75,114,115],{},"Azure Compute Gallery"," replaced ",[75,118,119],{},"Shared Image Gallery"," (functionally identical, just renamed).",[95,122,123,126],{},[75,124,125],{},"Azure Update Manager"," replaced the older Automation-based Update Management feature.",[95,128,129,132],{},[75,130,131],{},"Azure Monitor Agent (AMA)"," replaced the legacy Log Analytics agent, which was retired in August 2024.",[68,134,135],{},"Use the new names. The exam does.",[63,137,139],{"id":138},"domain-1-manage-identities-and-governance-2025","Domain 1 — Manage identities and governance (20–25%)",[68,141,142],{},"The biggest single domain, and the one where almost every question starts with \"You have a Microsoft Entra ID tenant that contains...\"",[68,144,145],{},[75,146,147],{},"You need to know cold:",[92,149,150,156,162,176,182,188,198,204],{},[95,151,152,155],{},[75,153,154],{},"Entra ID identity types",": cloud-only, synchronized (from on-prem AD via Entra Connect), and guest users (B2B collaboration).",[95,157,158,161],{},[75,159,160],{},"Group membership types",": Assigned, Dynamic User, Dynamic Device. Dynamic groups require Entra ID P1 minimum.",[95,163,164,167,168,171,172,175],{},[75,165,166],{},"Entra ID license tiers and what each unlocks",": Free, Microsoft 365 Apps, ",[75,169,170],{},"P1"," (Conditional Access, dynamic groups, SSPR with on-prem write-back), ",[75,173,174],{},"P2"," (Privileged Identity Management, Identity Protection, access reviews). Conditional Access is the single feature most commonly tested at the P1 boundary; PIM is the P2 marker.",[95,177,178,181],{},[75,179,180],{},"Conditional Access signals",": user, location (named/trusted IP ranges), cloud app, device state, sign-in risk. Multiple signals combine into one policy.",[95,183,184,187],{},[75,185,186],{},"Azure RBAC's four-element model",": security principal (who) × role definition (what) × scope (where) × assignment (binding). Built-in roles you must distinguish: Owner (full + manage access), Contributor (full minus access), Reader, User Access Administrator (manages role assignments only). The exam often asks \"least-privilege role\" — Contributor is the right answer when the user shouldn't be able to grant access to others.",[95,189,190,193,194,197],{},[75,191,192],{},"Hierarchy and inheritance",": Tenant Root → Management Group → Subscription → Resource Group → Resource. Policy and RBAC assignments inherit downward. Tags do ",[87,195,196],{},"not"," inherit by default — propagation requires Azure Policy's \"Inherit a tag\" rule.",[95,199,200,203],{},[75,201,202],{},"Azure Policy effects",": Audit, Deny, Append, Modify, DeployIfNotExists, AuditIfNotExists. Deny is the one you'll be asked about for \"prevent non-compliant deployments.\"",[95,205,206,209],{},[75,207,208],{},"Resource locks",": CanNotDelete (modify OK, delete blocked) vs ReadOnly (no modify, no delete). Locks at parent scopes inherit downward.",[68,211,212,215,216,219],{},[75,213,214],{},"Common trap:"," confusing RBAC roles with Entra ID ",[87,217,218],{},"directory"," roles. RBAC controls Azure resources; directory roles (e.g., Global Administrator, User Administrator) control the Entra ID tenant itself. They're separate systems with separate role lists.",[63,221,223],{"id":222},"domain-2-implement-and-manage-storage-1520","Domain 2 — Implement and manage storage (15–20%)",[68,225,226,227,230],{},"The smallest domain by weight but the one where students drop points on ",[75,228,229],{},"replication-option questions"," because the four-letter acronyms (LRS / ZRS / GRS / GZRS) blur together.",[68,232,233],{},[75,234,147],{},[92,236,237,243,282,288,294,300],{},[95,238,239,242],{},[75,240,241],{},"Storage account performance tiers",": Standard (HDD-backed) vs Premium (SSD-backed, separate account kinds for BlockBlob / FileStorage / Page Blob).",[95,244,245,248,249],{},[75,246,247],{},"Replication options at the Standard tier",":\n",[92,250,251,257,263,273],{},[95,252,253,256],{},[75,254,255],{},"LRS"," — 3 copies in one datacenter. Cheapest. Survives disk/rack failure.",[95,258,259,262],{},[75,260,261],{},"ZRS"," — 3 copies across 3 Availability Zones in one region. Survives a full AZ outage.",[95,264,265,268,269,272],{},[75,266,267],{},"GRS"," — LRS in primary + async copy to paired region. Survives a regional outage. Reads from secondary require ",[75,270,271],{},"RA-GRS",".",[95,274,275,278,279,272],{},[75,276,277],{},"GZRS"," — ZRS in primary + async copy to paired region. Survives AZ outage AND regional outage. Reads from secondary require ",[75,280,281],{},"RA-GZRS",[95,283,284,287],{},[75,285,286],{},"Blob access tiers",": Hot (frequent access), Cool (≥30-day retention, lower storage cost), Cold (≥90-day, even cheaper), Archive (≥180-day, offline, hours to rehydrate). Lifecycle Management policies automate tier transitions.",[95,289,290,293],{},[75,291,292],{},"Azure Files vs Blob",": Files = managed SMB/NFS shares (mountable from cloud and on-prem). Blob = object storage with HTTPS/REST access. Pick the one the question's access pattern requires.",[95,295,296,299],{},[75,297,298],{},"Security primitives",": storage account access keys (full control — rotate via Key Vault), Shared Access Signatures (account-level, service-level, user-delegation), Private Endpoints (most secure — private IP inside your VNet, traffic never traverses the internet).",[95,301,302,305],{},[75,303,304],{},"Soft delete and versioning"," protect against accidental deletion. Defaults: 7-day blob soft delete, container soft delete optional.",[68,307,308,310,311,314],{},[75,309,214],{}," picking GRS when the question requires AZ-loss survivability. GRS is multi-region but its ",[87,312,313],{},"primary"," copy is LRS — so a primary-region AZ failure can affect availability before failover. Use GZRS for both.",[63,316,318],{"id":317},"domain-3-deploy-and-manage-azure-compute-resources-2025","Domain 3 — Deploy and manage Azure compute resources (20–25%)",[68,320,321],{},"Co-largest domain with identities. Heavy on scenario-based \"which compute service\" and \"which configuration achieves this SLA\" questions.",[68,323,324],{},[75,325,147],{},[92,327,328,372,386,392,398,404,410],{},[95,329,330,248,333],{},[75,331,332],{},"VM availability constructs and their SLAs",[92,334,335,341,347,361],{},[95,336,337,338,272],{},"Single VM with Premium SSD: ",[75,339,340],{},"99.9%",[95,342,343,344,272],{},"Two+ VMs in an Availability Set (multi-fault-domain, multi-update-domain, single datacenter): ",[75,345,346],{},"99.95%",[95,348,349,350,353,354,357,358,272],{},"Two+ VMs across ",[75,351,352],{},"Availability Zones"," + ",[75,355,356],{},"zone-redundant managed disks",": ",[75,359,360],{},"99.99%",[95,362,363,364,367,368,371],{},"The 99.99% SLA requires ",[87,365,366],{},"both"," — VMs across AZs ",[87,369,370],{},"and"," ZRS-managed disks. Many candidates forget the disk requirement.",[95,373,374,377,378,381,382,385],{},[75,375,376],{},"VM Scale Sets (VMSS)",": Uniform orchestration (identical VMs, legacy default) vs ",[75,379,380],{},"Flexible"," orchestration (mixed sizes, can incorporate standalone VMs, ",[75,383,384],{},"now Microsoft's recommended default",").",[95,387,388,391],{},[75,389,390],{},"Disk SKUs",": Standard HDD, Standard SSD, Premium SSD (most common production choice), Premium SSD v2, Ultra Disk (extreme IOPS, separate billing).",[95,393,394,397],{},[75,395,396],{},"App Service",": managed PaaS, deployment slots for zero-downtime swap and A/B testing. Slots are the answer for \"test a new version then promote with no downtime.\"",[95,399,400,403],{},[75,401,402],{},"Container services",": ACI (single containers, no orchestration, fastest start), Container Apps (managed serverless, scale to zero), AKS (managed Kubernetes). ACR is the private registry.",[95,405,406,409],{},[75,407,408],{},"Functions Consumption plan timeout",": 10 minutes maximum.",[95,411,412,415],{},[75,413,414],{},"Bastion"," is the answer for \"RDP/SSH to a VM with no public IP, without a self-managed jump-box.\"",[68,417,418,420],{},[75,419,214],{}," confusing Availability Sets (single-datacenter, 99.95%) with Availability Zones (multi-datacenter, 99.99%). The exam will use both terms in distractors.",[63,422,424],{"id":423},"domain-4-implement-and-manage-virtual-networking-1520","Domain 4 — Implement and manage virtual networking (15–20%)",[68,426,427],{},"The networking domain rewards crisp service-layer recognition. The four load-balancing services are the #1 distractor source.",[68,429,430],{},[75,431,147],{},[92,433,434,440,446,456,465,475,514],{},[95,435,436,439],{},[75,437,438],{},"VNets and subnets",": 5 reserved IPs per subnet (network, default gateway, two DNS, broadcast). Plan CIDR accordingly.",[95,441,442,445],{},[75,443,444],{},"NSG rules",": priority 100–4096, lower wins, first match wins. Default rules: VNet-to-VNet allow inbound, Load Balancer inbound allow, internet outbound allow, everything else denied.",[95,447,448,451,452,455],{},[75,449,450],{},"Application Security Groups (ASGs)",": group NICs by role (web, db, app) so NSG rules reference ",[87,453,454],{},"roles",", not IPs. Adding/removing VMs from the ASG doesn't require rule edits.",[95,457,458,461,462,464],{},[75,459,460],{},"VNet peering is non-transitive",": A↔B and B↔C does ",[87,463,196],{}," give A↔C. Hub-and-spoke topologies use a Network Virtual Appliance, Azure Firewall, or Route Server in the hub for transit.",[95,466,467,470,471,474],{},[75,468,469],{},"Hybrid connectivity",": Site-to-Site VPN (encrypted tunnel over internet, slower), Point-to-Site VPN (individual client to VNet), ",[75,472,473],{},"ExpressRoute"," (dedicated private circuit, fastest, most expensive).",[95,476,477,248,480],{},[75,478,479],{},"The four load-balancing services and their distinct purposes",[92,481,482,488,494,504],{},[95,483,484,487],{},[75,485,486],{},"Azure Load Balancer"," — Layer 4 (TCP/UDP), regional, public or internal.",[95,489,490,493],{},[75,491,492],{},"Application Gateway"," — Layer 7 (HTTP/HTTPS), regional, supports URL-path routing, WAF, SSL termination.",[95,495,496,499,500,503],{},[75,497,498],{},"Azure Front Door"," — Layer 7, ",[75,501,502],{},"global"," (anycast), built-in WAF and CDN.",[95,505,506,509,510,513],{},[75,507,508],{},"Traffic Manager"," — DNS-based global routing. ",[75,511,512],{},"Not in the data path"," — it returns DNS responses and clients connect directly to endpoints.",[95,515,516,519],{},[75,517,518],{},"NAT Gateway"," for deterministic outbound internet connectivity from a subnet without per-VM public IPs.",[68,521,522,524],{},[75,523,214],{}," picking Traffic Manager when the question implies request-level routing. Traffic Manager only does DNS. If the question mentions \"URL-based routing,\" \"SSL termination,\" or \"WAF\" — that's Application Gateway (regional) or Front Door (global).",[63,526,528],{"id":527},"domain-5-monitor-and-maintain-azure-resources-1015","Domain 5 — Monitor and maintain Azure resources (10–15%)",[68,530,531],{},"The smallest domain, but every question is about distinct telemetry types and recovery services that students conflate.",[68,533,534],{},[75,535,147],{},[92,537,538,572,578,584,604,610],{},[95,539,540,248,543],{},[75,541,542],{},"Azure Monitor's four telemetry types and what each captures",[92,544,545,551,560,566],{},[95,546,547,550],{},[75,548,549],{},"Metrics"," — numeric time-series, near-real-time, retained ~93 days.",[95,552,553,556,557,272],{},[75,554,555],{},"Logs"," — structured log data in a Log Analytics workspace, queried with ",[75,558,559],{},"Kusto Query Language (KQL)",[95,561,562,565],{},[75,563,564],{},"Activity Log"," — subscription-level audit of management operations (who created/deleted what), retained 90 days by default.",[95,567,568,571],{},[75,569,570],{},"Resource Logs"," — per-resource diagnostic logs, must be enabled via a diagnostic setting to flow to Log Analytics / Storage / Event Hub.",[95,573,574,577],{},[75,575,576],{},"Diagnostic settings"," route Resource Logs to three valid destinations: Log Analytics workspace, Storage account, Event Hub.",[95,579,580,583],{},[75,581,582],{},"Alerts",": metric alerts (numeric thresholds), log alerts (KQL-based), activity log alerts (management-plane events). Action groups deliver notifications (email, SMS, webhook, runbook).",[95,585,586,589,590],{},[75,587,588],{},"Azure Backup vs Azure Site Recovery (ASR)"," — students confuse these constantly:\n",[92,591,592,598],{},[95,593,594,597],{},[75,595,596],{},"Backup"," = point-in-time restore. Recovery Services vault stores backup data. Sources: Azure VMs, Azure Files, SQL/SAP HANA in Azure VMs, on-prem via MARS agent.",[95,599,600,603],{},[75,601,602],{},"ASR"," = disaster recovery / failover to a secondary region. Recovery plans orchestrate failover order. Test failover validates without disrupting production.",[95,605,606,609],{},[75,607,608],{},"Cross-region restore"," is available when the Recovery Services vault uses Geo-Redundant Storage.",[95,611,612,615,616,619],{},[75,613,614],{},"Azure Service Health"," shows incidents and planned maintenance scoped to ",[87,617,618],{},"your"," resources. Differs from Azure Status (the public site listing all services worldwide).",[68,621,622,624],{},[75,623,214],{}," picking Azure Backup when the question describes regional failover. Backup is point-in-time restore. ASR is the failover/DR product.",[63,626,628],{"id":627},"whats-not-on-the-az-104","What's NOT on the AZ-104",[68,630,631],{},"A lot of free study material covers things that aren't really tested. Don't waste time deep-diving on:",[92,633,634,640,646,652,658,664],{},[95,635,636,639],{},[75,637,638],{},"Solution architecture patterns"," — that's AZ-305 territory (Solutions Architect Expert).",[95,641,642,645],{},[75,643,644],{},"Power BI, Azure Synapse, Data Factory"," — out of scope, those are data-platform exams.",[95,647,648,651],{},[75,649,650],{},"Detailed Azure Active Directory B2C"," — Entra ID for employees and guests is in scope; B2C is a separate exam track.",[95,653,654,657],{},[75,655,656],{},"Deep DevOps tooling"," (Azure Pipelines internals, GitHub Actions YAML) — AZ-400.",[95,659,660,663],{},[75,661,662],{},"Container Apps internals beyond \"what is it for\""," — covered briefly, not in depth.",[95,665,666,669],{},[75,667,668],{},"Cost-optimization deep dives"," — Reserved Instances, Savings Plans, Spot VMs appear at most once each.",[63,671,673],{"id":672},"the-seven-services-you-cannot-afford-to-confuse","The seven services you cannot afford to confuse",[68,675,676],{},"If you only memorize one thing from this guide, make it the difference between these similar-sounding services. The exam tests these distinctions on at least 5–8 questions:",[678,679,680,685,690,695,700,705,710],"ol",{},[95,681,682,272],{},[75,683,684],{},"Azure Load Balancer (L4) vs Application Gateway (L7 regional) vs Front Door (L7 global) vs Traffic Manager (DNS)",[95,686,687,272],{},[75,688,689],{},"Availability Sets (single DC, 99.95%) vs Availability Zones (multi-DC, 99.99%)",[95,691,692,272],{},[75,693,694],{},"NSG (subnet/NIC firewall) vs ASG (NIC role grouping) vs Azure Firewall (managed L7 firewall NVA)",[95,696,697,272],{},[75,698,699],{},"Azure Backup (point-in-time restore) vs Azure Site Recovery (regional failover)",[95,701,702,272],{},[75,703,704],{},"Activity Log (management plane) vs Resource Logs (data plane)",[95,706,707,272],{},[75,708,709],{},"Service Endpoints (VNet-aware public endpoint firewall) vs Private Endpoints (private IP in your VNet)",[95,711,712,272],{},[75,713,714],{},"Owner (full + manage access) vs Contributor (full minus access) vs User Access Administrator (manage access only)",[63,716,718],{"id":717},"how-to-study-efficiently","How to study efficiently",[68,720,721,722,725],{},"The AZ-104 rewards ",[75,723,724],{},"scenario recognition over service depth",". You don't need to know every Azure CLI flag or portal blade — you need to recognize 60+ services and pick the right one for a \"You have an Azure subscription that contains...\" stem. The best study loop is:",[678,727,728,731,738,741,744],{},[95,729,730],{},"Read Microsoft Learn or a structured course module for one domain.",[95,732,733,734,737],{},"Immediately drill ",[75,735,736],{},"20–30 scenario questions"," on that domain.",[95,739,740],{},"When you get one wrong, read the explanation and add the distractor pattern to a notes file (\"I keep picking GRS when GZRS is correct because I forget AZ-loss survivability\").",[95,742,743],{},"After all five domains, run a full simulated exam under timed conditions.",[95,745,746,747,272],{},"In the final week, focus drills on whichever domain is ",[87,748,749],{},"furthest below 75%",[68,751,752,757],{},[753,754,756],"a",{"href":755},"/exams/az-104","Quizify's Microsoft AZ-104 track"," is built for exactly this loop. Per-domain focus mode lets you drill Networking alone, then Identities alone, then Compute alone — and per-domain analytics tell you exactly where your score is leaking before you sit the real exam. Multi-select \"Select TWO\" and \"Select THREE\" questions appear in the mix because they appear on the real exam too.",[63,759,761],{"id":760},"the-bottom-line","The bottom line",[68,763,764],{},"The AZ-104 is the most reasonable mid-level cloud certification in the industry, but only if you study current Azure terminology and the five official skill domains. Skip the architect-level depth (that's AZ-305), avoid old AZ-103 study material that still calls Entra ID \"Azure AD,\" and drill scenario questions per domain until your weakest domain is at least 75%.",[68,766,767],{},[753,768,769],{"href":755},"Start drilling Microsoft AZ-104 questions →",{"title":771,"searchDepth":772,"depth":772,"links":773},"",2,[774,775,776,777,778,779,780,781,782,783,784],{"id":65,"depth":772,"text":66},{"id":81,"depth":772,"text":82},{"id":138,"depth":772,"text":139},{"id":222,"depth":772,"text":223},{"id":317,"depth":772,"text":318},{"id":423,"depth":772,"text":424},{"id":527,"depth":772,"text":528},{"id":627,"depth":772,"text":628},{"id":672,"depth":772,"text":673},{"id":717,"depth":772,"text":718},{"id":760,"depth":772,"text":761},"2026-05-20T00:00:00.000Z","A complete domain-by-domain breakdown of the AZ-104 exam: the five official skill areas, the services that get over-tested, the modern Azure terminology you must use (Entra ID, not Azure AD), and the topics you can safely deprioritize.","md",{"src":789},"https://images.unsplash.com/photo-1451187580459-43490279c0fa?q=80&w=1200&h=400&auto=format&fit=crop",{},true,"/blog/az-104-study-guide",{"title":50,"description":786},"3.blog/7.az-104-study-guide","rn1-iuSzB11ZOrZuMx9iDJF5Efl8MRR2CGsqU49Si9k",[797,798],null,{"title":799,"path":800,"stem":801,"description":802,"draft":22,"children":-1},"CLF-C02 Service Cheat-Sheet: The 40 AWS Services You Must Recognize on Sight","/blog/clf-c02-services-cheatsheet","3.blog/8.clf-c02-services-cheatsheet","The AWS Certified Cloud Practitioner exam loves to test service recognition under time pressure. Here are the 40 services that show up the most, grouped by category, with one-line definitions you can memorize the night before.",1782896922692]