AZ-104 Exam Flashcards

Q: What do AZ-104 flashcards help you memorize?

These AZ-104 flashcards reinforce Azure administrator terms across identity, governance, storage, compute, virtual networking, monitoring, backup, and recovery.

Q: Are AZ-104 flashcards enough for exam prep?

Flashcards help with recall, but AZ-104 is hands-on and scenario heavy. Pair them with Azure portal practice, Microsoft Learn labs, and full practice questions.

Q: When should I use AZ-104 flashcards?

Use them after each study session to test recall, then revisit missed cards before practicing configuration and troubleshooting scenarios.

Question 1

Microsoft Entra ID

Accepted Answer

Microsoft Entra ID is Azure's cloud identity and access service. AZ-104 expects you to manage users, groups, authentication, app identities, and access control.

Question 2

Member user

Accepted Answer

A member user is an internal user account in a tenant. Member accounts are used for employees and can receive licenses, roles, and group membership.

Question 3

Guest user

Accepted Answer

A guest user is an external identity invited into a tenant for collaboration. Guest access supports business-to-business sharing without creating a full internal account.

Question 4

Service principal

Accepted Answer

A service principal is an application identity used by apps, scripts, and automation. It supports least-privilege access without using a human user account.

Question 5

Managed identity

Accepted Answer

A managed identity gives an Azure resource an automatically managed identity in Entra ID. It avoids storing credentials in code for Azure resource access.

Question 6

Security group

Accepted Answer

A security group is used to assign access to resources for multiple users or devices. It simplifies permission management and supports RBAC assignments.

Question 7

Dynamic group

Accepted Answer

A dynamic group updates membership based on user or device attributes. It reduces manual administration when membership follows clear rules.

Question 8

SSPR

Accepted Answer

Self-service password reset lets users reset their own passwords after verifying identity. It reduces help desk workload and improves account recovery.

Question 9

MFA

Accepted Answer

Multi-factor authentication requires more than one proof of identity. It reduces risk when passwords are stolen or guessed.

Question 10

Azure RBAC

Accepted Answer

Azure role-based access control grants permissions to Azure resources through role assignments. It combines a security principal, role definition, and scope.

Question 11

RBAC scope

Accepted Answer

RBAC scope can be management group, subscription, resource group, or resource. Assign at the smallest practical scope to follow least privilege.

Question 12

Built-in role

Accepted Answer

A built-in role is a predefined Azure role such as Owner, Contributor, Reader, or Virtual Machine Contributor. Use built-ins before creating custom roles when they fit.

Question 13

Azure Policy

Accepted Answer

Azure Policy evaluates resources against rules and can deny, audit, or modify configurations. It enforces compliance but does not grant user permissions.

Question 14

Policy initiative

Accepted Answer

A policy initiative groups multiple policy definitions. It helps assign and track a compliance standard as one package.

Question 15

Resource lock

Accepted Answer

A resource lock prevents accidental deletion or modification. Delete locks block deletion, while read-only locks block updates as well.

Question 16

Management group

Accepted Answer

A management group organizes subscriptions into a hierarchy. It lets administrators apply RBAC and policy across many subscriptions.

Question 17

Tags

Accepted Answer

Tags are name-value metadata applied to Azure resources. They support cost allocation, ownership tracking, automation, and governance reporting.

Question 18

Budget alert

Accepted Answer

A budget alert notifies stakeholders when spending reaches configured thresholds. It helps administrators monitor and control Azure costs.

Question 19

Storage account

Accepted Answer

A storage account is the top-level namespace for Azure Storage services. It contains blobs, files, queues, and tables and controls redundancy, networking, and access.

Question 20

Blob storage

Accepted Answer

Blob storage stores unstructured object data such as images, backups, logs, and documents. Access tiers help balance cost and retrieval needs.

Question 21

Azure Files

Accepted Answer

Azure Files provides managed SMB and NFS file shares. It is useful for lift-and-shift file shares and shared storage across VMs.

Question 22

Hot access tier

Accepted Answer

The hot tier is optimized for frequently accessed blob data. It has higher storage cost but lower access cost than cooler tiers.

Question 23

Cool access tier

Accepted Answer

The cool tier is for infrequently accessed data retained for at least 30 days. It lowers storage cost but increases access cost.

Question 24

Archive access tier

Accepted Answer

The archive tier is for rarely accessed blob data with high retrieval latency. Data must be rehydrated before it can be read.

Question 25

SAS token

Accepted Answer

A shared access signature grants delegated access to storage resources for a limited time and permission set. It avoids sharing account keys.

Question 26

Storage firewall

Accepted Answer

A storage firewall restricts storage account network access by public network rules, selected networks, or private endpoints. It reduces exposure to unwanted traffic.

Question 27

Soft delete

Accepted Answer

Soft delete retains deleted blobs, file shares, or containers for a recovery period. It protects against accidental or malicious deletion.

Question 28

Lifecycle management

Accepted Answer

Lifecycle management moves or deletes blob data based on rules such as age or access time. It automates storage cost optimization.

Question 29

ARM template

Accepted Answer

An ARM template declaratively defines Azure resources in JSON. It enables repeatable deployments and infrastructure as code.

Question 30

Bicep

Accepted Answer

Bicep is a domain-specific language for Azure infrastructure as code. It compiles to ARM templates with cleaner syntax.

Question 31

Availability set

Accepted Answer

An availability set spreads VMs across fault and update domains inside a datacenter. It reduces downtime from hardware failures and planned maintenance.

Question 32

Availability zone

Accepted Answer

An availability zone is a physically separate datacenter zone within a region. Zone deployment protects workloads from datacenter-level failures.

Question 33

VM Scale Set

Accepted Answer

A VM Scale Set manages a group of identical VMs with autoscale and load balancing. It supports scalable compute for stateless workloads.

Question 34

Custom Script Extension

Accepted Answer

The Custom Script Extension runs scripts on Azure VMs after deployment. It is used for configuration, software installation, and bootstrap tasks.

Question 35

Azure App Service

Accepted Answer

Azure App Service hosts web apps, APIs, and mobile back ends without managing servers. Administrators manage plans, scaling, deployment slots, and settings.

Question 36

Deployment slot

Accepted Answer

A deployment slot is a separate App Service environment for staging changes. Slot swaps reduce downtime and allow validation before production release.

Question 37

Azure Container Registry

Accepted Answer

Azure Container Registry stores private container images. It integrates with Azure container services for controlled image distribution.

Question 38

Virtual network

Accepted Answer

A virtual network provides private IP address space for Azure resources. It is the foundation for subnets, routing, security rules, and connectivity.

Question 39

Subnet

Accepted Answer

A subnet divides a virtual network into smaller address ranges. Azure resources are placed in subnets so routing and security can be managed.

Question 40

NSG

Accepted Answer

A network security group filters inbound and outbound traffic using security rules. NSGs can be associated with subnets or network interfaces.

Question 41

ASG

Accepted Answer

An application security group lets NSG rules target groups of VM network interfaces by application role. It simplifies rule management for multi-tier apps.

Question 42

VNet peering

Accepted Answer

VNet peering connects virtual networks over Microsoft's backbone network. Peered VNets can communicate privately but address spaces cannot overlap.

Question 43

Private endpoint

Accepted Answer

A private endpoint exposes an Azure service through a private IP in a VNet. It keeps service traffic off the public internet.

Question 44

Service endpoint

Accepted Answer

A service endpoint extends VNet identity to supported Azure services while using public service endpoints. It helps restrict access to selected VNets.

Question 45

Azure Bastion

Accepted Answer

Azure Bastion provides browser-based RDP and SSH to VMs over TLS without public IP addresses on the VMs. It improves secure admin access.

Question 46

Azure Monitor

Accepted Answer

Azure Monitor collects metrics, logs, and activity data from Azure resources. It supports alerting, dashboards, and troubleshooting.

Question 47

Log Analytics workspace

Accepted Answer

A Log Analytics workspace stores Azure Monitor log data for queries and analysis. KQL is used to search and analyze logs.

Question 48

Action group

Accepted Answer

An action group defines who or what is notified when an alert fires. It can send email, SMS, webhook, ITSM, or automation actions.

Question 49

Recovery Services vault

Accepted Answer

A Recovery Services vault stores backup and site recovery data. It is used for Azure Backup and Azure Site Recovery management.

Question 50

Azure Site Recovery

Accepted Answer

Azure Site Recovery replicates workloads for disaster recovery and orchestrates failover. It matters for business continuity planning.

Free AZ-104 Exam Flashcards

Filter by Topic

Jump to Card

About These AZ-104 Flashcards

Topics Covered

Frequently Asked Questions

Azure AZ-104

Explore More Microsoft Azure Certifications

Azure DP-700

Azure AI-900

Azure AZ-900

Azure SC-900

Azure AI-102

Azure Data Engineering Associate (DP-203)

More From This Family