AZ-104 Cheat Sheet: Check Your Administrative Decisions Cheat Sheet
Cheat sheet: compare commonly confused Azure administration controls and review short CLI, Bicep deployment, and KQL examples for AZ-104.
Use this reference after an IT Mastery question exposes a gap. Find the relevant distinction, review the example, then try a different scenario. The blueprint map shows the broader coverage. Use IT Mastery for varied questions, then run this checklist before your next mixed session. Mark a task for review when you cannot explain the deciding fact, even if you remember the answer. Use the distinctions and example commands in this cheat sheet to decide what to practise again.
Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.
Access, governance, and storage
| Distinction | What to check |
|---|---|
| Microsoft Entra role / Azure role | Whether the operation manages directory objects or Azure resources. |
| Management / data permission | The requested operation and the applicable role permissions, rather than whether the resource is visible in the portal. |
| Policy / resource lock | Whether a rule evaluates configuration or a management lock blocks an operation. |
| Service SAS / account SAS / user delegation SAS | Required services, resource scope, signing authority, and revocation method. |
| Storage network access / authorization | Whether the request can reach the service and whether its credentials permit the operation. |
| Redundancy / recovery features | Whether the problem is infrastructure failure, unwanted modification, deletion, or a required historical recovery point. |
Microsoft separates directory and Azure roles . Resource locks apply to management operations and do not protect every data operation; see lock behavior . Use the scenario’s account and feature settings for storage decisions.
Notes and examples
Access and governance
- Given an access-assignment table, identify the principal, role, scope, and inherited access.
- Explain whether the task needs directory administration, resource management, or a data operation.
- Distinguish a policy result from a lock or permission problem.
- Explain how a tag, budget, or management-group change affects the stated requirement.
Check your reasoning: a Microsoft Entra administrative role is not an automatic Azure resource role. Likewise, permission to view resource configuration does not by itself establish permission to read the resource’s data. Microsoft’s role comparison explains the directory/resource boundary.
Deployment and network evidence
| Evidence | Read it this way |
|---|---|
| Bicep property reference | Determine whether it creates a deployment dependency on another resource. |
| What-if result | Inspect the predicted resource and property changes before deployment. |
| Peering diagram | Read each connection’s meaning; do not assume a connection through an intermediate VNet is automatically usable. |
| NSG table | Match direction, protocol, addresses, and ports; a lower priority number wins among matching rules. |
| Load-balancer probe result | Check probe protocol and port, the backend listener, and permitted probe traffic. |
| App Service VNet integration / private endpoint | Integration provides an outbound path to the VNet; a private endpoint provides inbound private access. |
Sources: Bicep dependencies , network security groups , and App Service VNet integration .
Inspect effective networking with Azure CLI
These examples inspect an existing network interface named nic-study in rg-study. Use your training environment’s resource names and the correct selected subscription. The NIC must be attached to a running VM for these effective-configuration queries. See effective route diagnostics
.
az network nic show-effective-route-table \
--resource-group rg-study \
--name nic-study
az network nic list-effective-nsg \
--resource-group rg-study \
--name nic-study
Compare the selected route with the relevant NSG decision. Either can explain a failed path, but neither output establishes that the guest application is listening. See the Azure CLI NIC reference .
Preview a Bicep deployment
For an existing training resource group and a local Bicep file, preview the proposed change:
az deployment group what-if \
--resource-group rg-study \
--template-file main.bicep
Supply any parameters your file requires. Read the affected resources and property changes; a preview is not an applied deployment, and its documented limitations still matter. See Bicep what-if .
Read an activity-log query
This KQL example counts records by operation and status over the previous day. It requires activity-log data in the selected Log Analytics workspace.
AzureActivity
| where TimeGenerated > ago(24h)
| summarize Records = count()
by OperationNameValue, ActivityStatusValue
| order by Records desc
A count of records is not necessarily a count of distinct operations: an operation can produce several lifecycle records. Missing collection also limits what the query can show. Field definitions are in Microsoft’s AzureActivity table reference .
Monitoring and protection choices
| Need | Starting point |
|---|---|
| Guest OS events or performance data | Azure Monitor Agent, the relevant data collection rule, and its association. |
| Resource logs in a destination | The resource’s diagnostic settings and supported categories. |
| Notify when a condition is met | Alert rule plus the required action group. |
| Suppress alert actions during maintenance | An alert processing rule with the appropriate scope and schedule. |
| Protect Azure VMs or Azure Files | A supported policy in a Recovery Services vault; see Azure Files backup . |
| Protect managed disks or blobs | A supported Backup vault configuration; check operational versus vaulted protection. |
| Recover service in a secondary region | Site Recovery replication and the relevant failover workflow. |
Notes and examples
See Microsoft’s alert overview , Recovery Services vault overview , Backup vault overview , and Site Recovery overview for supported operations and prerequisites.
Use the scenario guide to apply these distinctions to a short exhibit.
Storage and recovery
- Diagnose network reachability and authorization separately.
- Read a SAS scope, permissions, validity, and signing method.
- Identify which copy, version, snapshot, or retained recovery point meets the recovery requirement.
- Check whether the client can wait for the selected storage tier’s retrieval process.
Check your reasoning: creating a private endpoint does not automatically disable the service’s public access. DNS and the storage account’s network settings remain separate checks. See Azure Storage private endpoints .
Deployments and compute
- Explain the purpose of a Bicep parameter, property reference, or module output.
- Determine prerequisites from dependencies, without relying on declaration order.
- Match VM encryption and availability settings to the actual protection requirement.
- Distinguish container resource sizing from replica scaling.
- Explain which App Service setting or connection is inbound, outbound, or attached to a deployment slot.
Check your reasoning: Azure Resource Manager uses resource dependencies and can deploy independent resources in parallel. Adding unnecessary dependsOn entries can reduce that parallelism. See Bicep dependencies
.
Network exhibits
- Trace the destination prefix, selected next hop, and permitted flow.
- Evaluate both subnet and network-interface security rules when both apply.
- Separate load-balancer probe traffic from application client traffic.
- Verify the service name resolves to the intended endpoint from the affected client.
Check your reasoning: an NSG allow rule permits a flow through that filter; it does not create a route, a listening application, or application-level authorization. Default rules also matter. Review the NSG rule model .
Monitoring and maintenance
- Check telemetry source, destination, collection start, and query time range.
- Distinguish the alert condition from notification actions and action suppression.
- Match the protected workload to a supported vault and policy.
- Explain whether the requirement is data restoration, test failover, actual failover, or reprotection.
Check your reasoning: Azure Monitor Agent uses associated data collection rules for guest telemetry; resource diagnostic settings serve a different collection path. Consult data collection rules and diagnostic settings .
Turn a gap into a useful next session
Choose one unchecked item and a short topic drill. After reviewing the explanation, change one condition mentally: scope, direction, resource type, retention, or time window. Explain whether that change would alter the decision.
Then return to mixed practice. If the same misunderstanding recurs, use the study plan to schedule a practical exercise. These checks identify review needs; they do not predict your certification result.