AZ-104 Cheat Sheet: Check Your Administrative Decisions Cheat Sheet

Cheat sheet: compare commonly confused Azure administration controls and review short CLI, Bicep deployment, and KQL examples for AZ-104.

Use this reference after an IT Mastery question exposes a gap. Find the relevant distinction, review the example, then try a different scenario. The blueprint map shows the broader coverage. Use IT Mastery for varied questions, then run this checklist before your next mixed session. Mark a task for review when you cannot explain the deciding fact, even if you remember the answer. Use the distinctions and example commands in this cheat sheet to decide what to practise again.

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

Access, governance, and storage

DistinctionWhat to check
Microsoft Entra role / Azure roleWhether the operation manages directory objects or Azure resources.
Management / data permissionThe requested operation and the applicable role permissions, rather than whether the resource is visible in the portal.
Policy / resource lockWhether a rule evaluates configuration or a management lock blocks an operation.
Service SAS / account SAS / user delegation SASRequired services, resource scope, signing authority, and revocation method.
Storage network access / authorizationWhether the request can reach the service and whether its credentials permit the operation.
Redundancy / recovery featuresWhether the problem is infrastructure failure, unwanted modification, deletion, or a required historical recovery point.

Microsoft separates directory and Azure roles . Resource locks apply to management operations and do not protect every data operation; see lock behavior . Use the scenario’s account and feature settings for storage decisions.

Notes and examples

Access and governance

  • Given an access-assignment table, identify the principal, role, scope, and inherited access.
  • Explain whether the task needs directory administration, resource management, or a data operation.
  • Distinguish a policy result from a lock or permission problem.
  • Explain how a tag, budget, or management-group change affects the stated requirement.

Check your reasoning: a Microsoft Entra administrative role is not an automatic Azure resource role. Likewise, permission to view resource configuration does not by itself establish permission to read the resource’s data. Microsoft’s role comparison explains the directory/resource boundary.

Deployment and network evidence

EvidenceRead it this way
Bicep property referenceDetermine whether it creates a deployment dependency on another resource.
What-if resultInspect the predicted resource and property changes before deployment.
Peering diagramRead each connection’s meaning; do not assume a connection through an intermediate VNet is automatically usable.
NSG tableMatch direction, protocol, addresses, and ports; a lower priority number wins among matching rules.
Load-balancer probe resultCheck probe protocol and port, the backend listener, and permitted probe traffic.
App Service VNet integration / private endpointIntegration provides an outbound path to the VNet; a private endpoint provides inbound private access.

Sources: Bicep dependencies , network security groups , and App Service VNet integration .

Inspect effective networking with Azure CLI

These examples inspect an existing network interface named nic-study in rg-study. Use your training environment’s resource names and the correct selected subscription. The NIC must be attached to a running VM for these effective-configuration queries. See effective route diagnostics .

az network nic show-effective-route-table \
  --resource-group rg-study \
  --name nic-study
az network nic list-effective-nsg \
  --resource-group rg-study \
  --name nic-study

Compare the selected route with the relevant NSG decision. Either can explain a failed path, but neither output establishes that the guest application is listening. See the Azure CLI NIC reference .

Preview a Bicep deployment

For an existing training resource group and a local Bicep file, preview the proposed change:

az deployment group what-if \
  --resource-group rg-study \
  --template-file main.bicep

Supply any parameters your file requires. Read the affected resources and property changes; a preview is not an applied deployment, and its documented limitations still matter. See Bicep what-if .

Read an activity-log query

This KQL example counts records by operation and status over the previous day. It requires activity-log data in the selected Log Analytics workspace.

AzureActivity
| where TimeGenerated > ago(24h)
| summarize Records = count()
    by OperationNameValue, ActivityStatusValue
| order by Records desc

A count of records is not necessarily a count of distinct operations: an operation can produce several lifecycle records. Missing collection also limits what the query can show. Field definitions are in Microsoft’s AzureActivity table reference .

Monitoring and protection choices

NeedStarting point
Guest OS events or performance dataAzure Monitor Agent, the relevant data collection rule, and its association.
Resource logs in a destinationThe resource’s diagnostic settings and supported categories.
Notify when a condition is metAlert rule plus the required action group.
Suppress alert actions during maintenanceAn alert processing rule with the appropriate scope and schedule.
Protect Azure VMs or Azure FilesA supported policy in a Recovery Services vault; see Azure Files backup .
Protect managed disks or blobsA supported Backup vault configuration; check operational versus vaulted protection.
Recover service in a secondary regionSite Recovery replication and the relevant failover workflow.
Notes and examples

See Microsoft’s alert overview , Recovery Services vault overview , Backup vault overview , and Site Recovery overview for supported operations and prerequisites.

Use the scenario guide to apply these distinctions to a short exhibit.

Storage and recovery

  • Diagnose network reachability and authorization separately.
  • Read a SAS scope, permissions, validity, and signing method.
  • Identify which copy, version, snapshot, or retained recovery point meets the recovery requirement.
  • Check whether the client can wait for the selected storage tier’s retrieval process.

Check your reasoning: creating a private endpoint does not automatically disable the service’s public access. DNS and the storage account’s network settings remain separate checks. See Azure Storage private endpoints .

Deployments and compute

  • Explain the purpose of a Bicep parameter, property reference, or module output.
  • Determine prerequisites from dependencies, without relying on declaration order.
  • Match VM encryption and availability settings to the actual protection requirement.
  • Distinguish container resource sizing from replica scaling.
  • Explain which App Service setting or connection is inbound, outbound, or attached to a deployment slot.

Check your reasoning: Azure Resource Manager uses resource dependencies and can deploy independent resources in parallel. Adding unnecessary dependsOn entries can reduce that parallelism. See Bicep dependencies .

Network exhibits

  • Trace the destination prefix, selected next hop, and permitted flow.
  • Evaluate both subnet and network-interface security rules when both apply.
  • Separate load-balancer probe traffic from application client traffic.
  • Verify the service name resolves to the intended endpoint from the affected client.

Check your reasoning: an NSG allow rule permits a flow through that filter; it does not create a route, a listening application, or application-level authorization. Default rules also matter. Review the NSG rule model .

Monitoring and maintenance

  • Check telemetry source, destination, collection start, and query time range.
  • Distinguish the alert condition from notification actions and action suppression.
  • Match the protected workload to a supported vault and policy.
  • Explain whether the requirement is data restoration, test failover, actual failover, or reprotection.

Check your reasoning: Azure Monitor Agent uses associated data collection rules for guest telemetry; resource diagnostic settings serve a different collection path. Consult data collection rules and diagnostic settings .

Turn a gap into a useful next session

Choose one unchecked item and a short topic drill. After reviewing the explanation, change one condition mentally: scope, direction, resource type, retention, or time window. Explain whether that change would alter the decision.

Then return to mixed practice. If the same misunderstanding recurs, use the study plan to schedule a practical exercise. These checks identify review needs; they do not predict your certification result.

Put the review into practice