Free AZ-104 Exam Flashcards

Microsoft Entra ID is Azure's cloud identity and access service. AZ-104 expects you to manage users, groups, authentication, app identities, and access control.

A member user is an internal user account in a tenant. Member accounts are used for employees and can receive licenses, roles, and group membership.

A guest user is an external identity invited into a tenant for collaboration. Guest access supports business-to-business sharing without creating a full internal account.

A service principal is an application identity used by apps, scripts, and automation. It supports least-privilege access without using a human user account.

A managed identity gives an Azure resource an automatically managed identity in Entra ID. It avoids storing credentials in code for Azure resource access.

A security group is used to assign access to resources for multiple users or devices. It simplifies permission management and supports RBAC assignments.

A dynamic group updates membership based on user or device attributes. It reduces manual administration when membership follows clear rules.

Self-service password reset lets users reset their own passwords after verifying identity. It reduces help desk workload and improves account recovery.

Multi-factor authentication requires more than one proof of identity. It reduces risk when passwords are stolen or guessed.

Azure role-based access control grants permissions to Azure resources through role assignments. It combines a security principal, role definition, and scope.

RBAC scope can be management group, subscription, resource group, or resource. Assign at the smallest practical scope to follow least privilege.

A built-in role is a predefined Azure role such as Owner, Contributor, Reader, or Virtual Machine Contributor. Use built-ins before creating custom roles when they fit.

Azure Policy evaluates resources against rules and can deny, audit, or modify configurations. It enforces compliance but does not grant user permissions.

A policy initiative groups multiple policy definitions. It helps assign and track a compliance standard as one package.

A resource lock prevents accidental deletion or modification. Delete locks block deletion, while read-only locks block updates as well.

A management group organizes subscriptions into a hierarchy. It lets administrators apply RBAC and policy across many subscriptions.

Tags are name-value metadata applied to Azure resources. They support cost allocation, ownership tracking, automation, and governance reporting.

A budget alert notifies stakeholders when spending reaches configured thresholds. It helps administrators monitor and control Azure costs.

A storage account is the top-level namespace for Azure Storage services. It contains blobs, files, queues, and tables and controls redundancy, networking, and access.

Blob storage stores unstructured object data such as images, backups, logs, and documents. Access tiers help balance cost and retrieval needs.

Azure Files provides managed SMB and NFS file shares. It is useful for lift-and-shift file shares and shared storage across VMs.

The hot tier is optimized for frequently accessed blob data. It has higher storage cost but lower access cost than cooler tiers.

The cool tier is for infrequently accessed data retained for at least 30 days. It lowers storage cost but increases access cost.

The archive tier is for rarely accessed blob data with high retrieval latency. Data must be rehydrated before it can be read.

A shared access signature grants delegated access to storage resources for a limited time and permission set. It avoids sharing account keys.

A storage firewall restricts storage account network access by public network rules, selected networks, or private endpoints. It reduces exposure to unwanted traffic.

Soft delete retains deleted blobs, file shares, or containers for a recovery period. It protects against accidental or malicious deletion.

Lifecycle management moves or deletes blob data based on rules such as age or access time. It automates storage cost optimization.

An ARM template declaratively defines Azure resources in JSON. It enables repeatable deployments and infrastructure as code.

Bicep is a domain-specific language for Azure infrastructure as code. It compiles to ARM templates with cleaner syntax.

An availability set spreads VMs across fault and update domains inside a datacenter. It reduces downtime from hardware failures and planned maintenance.

An availability zone is a physically separate datacenter zone within a region. Zone deployment protects workloads from datacenter-level failures.

A VM Scale Set manages a group of identical VMs with autoscale and load balancing. It supports scalable compute for stateless workloads.

The Custom Script Extension runs scripts on Azure VMs after deployment. It is used for configuration, software installation, and bootstrap tasks.

Azure App Service hosts web apps, APIs, and mobile back ends without managing servers. Administrators manage plans, scaling, deployment slots, and settings.

A deployment slot is a separate App Service environment for staging changes. Slot swaps reduce downtime and allow validation before production release.

Azure Container Registry stores private container images. It integrates with Azure container services for controlled image distribution.

A virtual network provides private IP address space for Azure resources. It is the foundation for subnets, routing, security rules, and connectivity.

A subnet divides a virtual network into smaller address ranges. Azure resources are placed in subnets so routing and security can be managed.

A network security group filters inbound and outbound traffic using security rules. NSGs can be associated with subnets or network interfaces.

An application security group lets NSG rules target groups of VM network interfaces by application role. It simplifies rule management for multi-tier apps.

VNet peering connects virtual networks over Microsoft's backbone network. Peered VNets can communicate privately but address spaces cannot overlap.

A private endpoint exposes an Azure service through a private IP in a VNet. It keeps service traffic off the public internet.

A service endpoint extends VNet identity to supported Azure services while using public service endpoints. It helps restrict access to selected VNets.

Azure Bastion provides browser-based RDP and SSH to VMs over TLS without public IP addresses on the VMs. It improves secure admin access.

Azure Monitor collects metrics, logs, and activity data from Azure resources. It supports alerting, dashboards, and troubleshooting.

A Log Analytics workspace stores Azure Monitor log data for queries and analysis. KQL is used to search and analyze logs.

An action group defines who or what is notified when an alert fires. It can send email, SMS, webhook, ITSM, or automation actions.

A Recovery Services vault stores backup and site recovery data. It is used for Azure Backup and Azure Site Recovery management.

Azure Site Recovery replicates workloads for disaster recovery and orchestrates failover. It matters for business continuity planning.