Microsoft Certified: Azure Administrator Associate (Exam AZ-104) Flashcards

It is shorter, unproctored, and open book, and can be completed online within a six-month renewal window before expiration.

A logical container that holds related resources for an Azure solution, used as the primary unit for applying access control, tags, and lifecycle management (deploy, update, delete together).

Manage Azure identities and governance; implement and manage storage; deploy and manage Azure compute resources; implement and manage virtual networking; and monitor and maintain Azure resources.

100 minutes, with an additional 30 minutes available if the candidate's preferred language is not offered for the exam.

700 or greater on a scale of 1 to 1,000.

No. No points are deducted for incorrect answers, so candidates should answer every question rather than leave it blank.

Pearson VUE, and the exam may include interactive, performance-based components in addition to multiple-choice items.

24 hours after the first attempt.

An overall numeric score, a pass/fail result, and a bar chart showing performance broken down by skill area (domain).

Renewal is required every 12 months, and renewal itself is free.

An authorization system built on Azure Resource Manager that grants fine-grained access to Azure resources by assigning roles (collections of permissions) to users, groups, service principals, or managed identities at a management group, subscription, resource group, or resource scope.

Management groups, then subscriptions, then resource groups, then individual resources.

To enforce organizational rules and effects (such as deny, audit, or append) on resource properties during creation and update, ensuring compliance with standards like naming conventions or allowed regions, distinct from RBAC which controls who can act.

Users are individual identities; groups aggregate users (or other groups) so administrators can assign roles and permissions once to the group rather than to each user individually.

A set of inbound and outbound security rules that filter network traffic by source/destination IP, port, and protocol, applied to subnets or individual network interfaces.

A mechanism that connects two virtual networks so resources in each can communicate directly using private IP addresses, without traversing the public internet, and (by default) without transitive routing through a peered network.

Azure Load Balancer operates at Layer 4 (TCP/UDP) distributing traffic across VMs based on network-level rules, while Application Gateway is a Layer 7 web traffic load balancer that can route based on URL path/host and provides features like SSL termination and a web application firewall.

Standard SKU public IPs are secure by default (require an explicit NSG rule to allow traffic) and support availability zones, while Basic SKU is open by default and does not support zone redundancy.

Locally Redundant Storage (LRS) replicates data three times within a single datacenter/region, while Geo-Redundant Storage (GRS) additionally replicates asynchronously to a secondary, geographically distant region for disaster recovery.

Hot (frequently accessed, higher storage cost/lower access cost), Cool (infrequently accessed, lower storage cost/higher access cost, minimum retention expectations), and Archive (rarely accessed, lowest storage cost, offline and requires rehydration before access).

It centralizes an organization's file shares in Azure Files while keeping the flexibility, performance, and compatibility of an on-premises file server through caching (cloud tiering) on a Windows Server endpoint.

A URI that grants delegated, time-limited access to specific storage resources with defined permissions, without sharing the account's access keys.

A logical grouping of VMs within a datacenter that spreads them across fault domains (separate power/network) and update domains (separate maintenance windows) to reduce the chance of correlated downtime.

A physically separate location within an Azure region, each with independent power, cooling, and networking, used to protect applications and data from datacenter-level failures with higher resiliency than availability sets alone.

An Azure compute resource that lets you deploy and manage a group of identical, load-balanced VMs, with the ability to automatically increase or decrease the number of instances based on demand or a defined schedule.

To assess and manage OS updates for Windows and Linux VMs across Azure, on-premises, and other clouds, allowing scheduled and controlled patch deployment.

Azure Monitor is the platform for collecting, analyzing, and acting on telemetry; metrics are lightweight numerical time-series values (e.g., CPU percentage) good for near-real-time alerting, while logs are structured event records queried with Kusto Query Language (KQL) for deeper analysis.

A managed service that centrally protects and restores data for VMs, files, folders, and other workloads by taking scheduled backups stored in a Recovery Services vault.

Disaster recovery that replicates workloads (VMs, physical servers) running in a primary location to a secondary location, and orchestrates failover and failback if an outage occurs.

A service principal is an identity created for an application or service to access Azure resources, typically requiring credential management; a managed identity is an automatically managed identity in Microsoft Entra ID tied to an Azure resource that eliminates the need to store credentials in code.