10.1 Domain Weight Triage and Study Prioritization

Start with the real weight of the exam

The current AZ-104 skills outline dated April 17, 2026 splits the exam into five domains. Manage Azure identities and governance is 20-25 percent. Deploy and manage Azure compute resources is also 20-25 percent. Implement and manage storage is 15-20 percent. Implement and manage virtual networking is 15-20 percent. Monitor and maintain Azure resources is 10-15 percent.

That distribution should shape your study time. It should not make you ignore monitoring because monitoring is lower weight. In an administrator exam, monitoring is often the evidence layer for every other domain. A VM boot issue, storage throttling issue, private endpoint DNS issue, backup failure, and policy denial can all surface through logs, metrics, alerts, activity logs, or resource health.

Use this practical weighting table when planning your final review.

Build a triage pass before solving

Many wrong AZ-104 answers happen because the candidate fixes the first plausible thing instead of identifying the layer that failed. Before picking a remediation, classify the scenario.

Ask four questions. First, is the problem control plane or data plane? A user unable to create a VM is control plane. A workload unable to read blobs is data plane. Second, is the failure identity, network, configuration, quota, policy, or health? Third, what evidence would prove it? Fourth, what is the least privileged or least disruptive change that meets the requirement?

Example: a user can open a storage account but cannot read blobs. That is usually data-plane authorization, not Reader at the storage account management scope. The likely remediation is a data role such as Storage Blob Data Reader at the right scope, assuming network rules also allow access. If the same user cannot see the storage account at all, management-plane Reader may be missing.

Example: a VM cannot reach a private storage endpoint. Do not start by regenerating access keys. Validate DNS resolution for the storage account name, the private DNS zone link, subnet route behavior, NSG rules, and storage firewall settings. Authentication can be correct while the packet path is broken.

Scenario tree for exam triage

Use this tree during practice:

1. Read the business requirement first: least privilege, no public access, minimize downtime, lowest cost, retain data, or automate repeatably.
2. Identify the affected resource type: user, group, subscription, storage account, VM, app, VNet, load balancer, vault, alert, or template.
3. Identify the failed operation: deploy, connect, authenticate, authorize, scale, move, back up, restore, monitor, or resolve name.
4. Map the failed operation to the likely tool: Azure portal, Azure CLI, PowerShell, ARM/Bicep, Network Watcher, Activity log, metrics, logs, or backup jobs.
5. Pick the smallest change that fixes the actual failure without weakening security.

This approach matters because AZ-104 scenarios often combine facts. A question might mention a VM, a storage account, a private endpoint, an NSG, and a managed identity. The answer is not automatically compute or storage. The clue is the failed operation. If the VM receives TCP timeouts to the storage endpoint, network path and DNS are leading suspects. If it receives authorization errors after connecting, identity and data-plane roles are leading suspects.

Time budgeting and Microsoft Learn discipline

The assessment time is 100 minutes for the exam form without labs, with 120 minutes seat duration for role-based exams without labs. Exams that may contain labs can have longer exam and seat duration, and Microsoft does not publish a fixed list of exams with labs. Question count is typically 40-60, but it can vary. Passing is 700 or greater.

Role-based exams can provide Microsoft Learn access, but no extra time is added. Treat it as a lookup tool for narrow uncertainty, not as an open research session. Learn access is restricted to learn.microsoft.com and excludes areas such as Q&A, Practice Assessments, and profile. If you spend six minutes searching for a role name you should have studied, you may lose two easier questions later.

Use Learn lookup only after you reduce the question to one missing fact. Good lookup target: which App Service tier supports a required feature, or which storage redundancy option supports a stated failover behavior. Poor lookup target: learning private endpoints from scratch during the exam.

Final-week study allocation

If you have ten focused study hours left, assign roughly two hours to identity and governance, two hours to compute, ninety minutes to storage, ninety minutes to networking, one hour to monitor and maintain, and two hours to mixed case labs. That last block is not optional. It teaches you to detect cross-domain failures quickly.

Use the local practice bank distribution as a second signal, not as the official exam blueprint. If your local missed questions cluster in networking and monitoring, spend more time there even if identity and compute have higher official weights. A mature study plan is weighted by both exam coverage and personal error rate.

Close each practice session with a remediation note. Write the symptom, the evidence, the actual root cause, and the smallest correct fix. For example: Symptom: App Service cannot pull image. Evidence: startup logs show unauthorized to ACR. Root cause: managed identity lacks AcrPull. Fix: assign AcrPull at registry scope and configure app registry identity. This habit turns practice questions into administrator muscle memory.