AZ-104 Cheat Sheet

#	Domain	Weight	Questions	Practice
1.0	Manage Azure Identities and Governance	24%	266	Practice →
2.0	Implement and Manage Storage	19%	234	Practice →
3.0	Deploy and Manage Azure Compute	24%	211	Practice →
4.0	Implement and Manage Virtual Networking	19%	294	Practice →
5.0	Monitor and Maintain Azure Resources	14%	194	Practice →
Total	100%	1,199

Domain

Weight

Questions

Practice

1.0

Manage Azure Identities and Governance

24%

266

Practice →

2.0

Implement and Manage Storage

19%

234

Practice →

3.0

Deploy and Manage Azure Compute

24%

211

Practice →

4.0

Implement and Manage Virtual Networking

19%

294

Practice →

5.0

Monitor and Maintain Azure Resources

14%

194

Practice →

Total

100%

1,199

Domain Quick Reference

1.0Manage Azure Identities and Governance

Manage Azure Identities and Governance tests Azure AD users and groups, RBAC role assignments, management groups, subscriptions, and Azure Policy.

24%

Key concepts

✓Azure AD objects: users, groups, service principals, and managed identities.
✓RBAC: built-in roles (Owner, Contributor, Reader), custom roles, and scope hierarchy.
✓Management groups, subscriptions, resource groups, and how policy inheritance flows down.
✓Azure Policy effects: Deny, Audit, Append, DeployIfNotExists, and Modify.

Watch out for

⚠Assuming Owner at the resource group level grants Owner access to the subscription — roles do not inherit upward.
⚠Confusing Azure AD roles (directory-level) with Azure RBAC roles (resource-level).
⚠Forgetting that Azure Policy can only enforce compliance going forward — existing non-compliant resources require a remediation task.
⚠Mixing up Deny (blocks creation) and Audit (logs non-compliance) policy effects.

2.0Implement and Manage Storage

Create and secure storage with az storage account create, choosing replication (LRS/ZRS/GRS) and access tiers (Hot/Cool/Archive); configure SAS tokens, Azure AD RBAC, lifecycle policies, and azcopy for Blob and Files. Get replication and tier selection right.

19%

Key concepts

✓Configure storage account replication, access tiers, and lifecycle management policies.
✓Generate and secure shared access signatures (SAS) with stored access policies.
✓Implement Azure Files shares and sync with Azure File Sync.
✓Manage Azure Blob storage containers, snapshots, and soft delete settings.

Watch out for

⚠Confusing LRS, ZRS, GRS, and RA-GRS replication options and their supported services and regions.
⚠Forgetting that a stored access policy is required to revoke a service SAS or account SAS.
⚠Assuming Azure File Sync requires a premium file share or that it supports SMB 1.0.

3.0Deploy and Manage Azure Compute

Candidates must deploy and manage VMs, scale sets, containers, and App Service using Azure CLI, PowerShell, or Bicep. The critical skill is configuring availability sets/zones and managed disks correctly, since these determine SLA and resilience.

24%

Key concepts

✓Selecting VM sizes, disk types, and availability sets versus Availability Zones for SLA and redundancy
✓Deploying and configuring VM Scale Sets, including autoscale rules and instance management
✓Configuring Azure App Service plans, deployment slots, and container-based web app hosting
✓Managing compute with Azure CLI, PowerShell, ARM templates, and moving VMs between resource groups

Watch out for

⚠Assuming a VM can be resized to any size without deallocating it first, or that resizing across clusters always succeeds without redeployment.
⚠Confusing Availability Sets with Availability Zones, then expecting zone-level fault isolation from an availability set deployment.
⚠Forgetting that managed disk type changes require the VM to be deallocated, and that some disk conversions are irreversible.

4.0Implement and Manage Virtual Networking

Candidates must configure VNets, subnets, NSGs, UDRs, peering, private endpoints, and Azure DNS using portal, CLI, or PowerShell. Get subnet delegation and NSG rule priority right, since misconfigured rules block traffic.

19%

Key concepts

✓Create and configure VNets, subnets, and IP addressing including service endpoints.
✓Configure NSG rules and application security groups to filter traffic.
✓Implement VNet peering, user-defined routes, and Azure DNS zones.
✓Set up private endpoints and Azure Bastion for secure access.

Watch out for

⚠Forgetting that NSG rules are stateful and that default rules allow VNet traffic but deny internet inbound.
⚠Assuming VNet peering is transitive; it is not, so you need UDRs or gateways for spoke-to-spoke.
⚠Overlooking that Azure reserves the first four and last IP address in each subnet.

5.0Monitor and Maintain Azure Resources

Configure Azure Monitor alerts with action groups, write KQL queries in Log Analytics, and set up Recovery Services vault backups. Get alert scopes and conditions right, since wrong signals cause missed or noisy notifications.

14%

Key concepts

✓Configuring Azure Monitor diagnostic settings to route resource logs to Log Analytics, Storage, or Event Hubs
✓Writing KQL queries in Log Analytics to filter, summarize, and aggregate Azure activity and resource logs
✓Creating metric and log search alerts with action groups, plus interpreting alert processing rules
✓Using Network Watcher tools like IP flow verify, connection troubleshoot, and NSG flow logs

Watch out for

⚠Confusing metric alerts with log search alerts, then choosing the wrong alert type for a requirement needing KQL query logic.
⚠Forgetting that diagnostic settings must be enabled per resource before logs appear in Log Analytics, so queries return nothing.
⚠Assuming Azure Backup automatically restores VMs; recovery requires selecting a recovery point and restore type in the vault.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For AZ-104, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
1.0	Manage Azure Identities and Governance	24%	266	Practice →
2.0	Implement and Manage Storage	19%	234	Practice →
3.0	Deploy and Manage Azure Compute	24%	211	Practice →
4.0	Implement and Manage Virtual Networking	19%	294	Practice →
5.0	Monitor and Maintain Azure Resources	14%	194	Practice →
Total	100%	1,199

Domain

Weight

Questions

Practice

1.0

Manage Azure Identities and Governance

24%

266

Practice →

2.0

Implement and Manage Storage

19%

234

Practice →

3.0

Deploy and Manage Azure Compute

24%

211

Practice →

4.0

Implement and Manage Virtual Networking

19%

294

Practice →

5.0

Monitor and Maintain Azure Resources

14%

194

Practice →

Total

100%

1,199

Domain Quick Reference

1.0Manage Azure Identities and Governance

Manage Azure Identities and Governance tests Azure AD users and groups, RBAC role assignments, management groups, subscriptions, and Azure Policy.

24%

Key concepts

✓Azure AD objects: users, groups, service principals, and managed identities.
✓RBAC: built-in roles (Owner, Contributor, Reader), custom roles, and scope hierarchy.
✓Management groups, subscriptions, resource groups, and how policy inheritance flows down.
✓Azure Policy effects: Deny, Audit, Append, DeployIfNotExists, and Modify.

Watch out for

⚠Assuming Owner at the resource group level grants Owner access to the subscription — roles do not inherit upward.
⚠Confusing Azure AD roles (directory-level) with Azure RBAC roles (resource-level).
⚠Forgetting that Azure Policy can only enforce compliance going forward — existing non-compliant resources require a remediation task.
⚠Mixing up Deny (blocks creation) and Audit (logs non-compliance) policy effects.

2.0Implement and Manage Storage

19%

Key concepts

✓Configure storage account replication, access tiers, and lifecycle management policies.
✓Generate and secure shared access signatures (SAS) with stored access policies.
✓Implement Azure Files shares and sync with Azure File Sync.
✓Manage Azure Blob storage containers, snapshots, and soft delete settings.

Watch out for

⚠Confusing LRS, ZRS, GRS, and RA-GRS replication options and their supported services and regions.
⚠Forgetting that a stored access policy is required to revoke a service SAS or account SAS.
⚠Assuming Azure File Sync requires a premium file share or that it supports SMB 1.0.

3.0Deploy and Manage Azure Compute

24%

Key concepts

✓Selecting VM sizes, disk types, and availability sets versus Availability Zones for SLA and redundancy
✓Deploying and configuring VM Scale Sets, including autoscale rules and instance management
✓Configuring Azure App Service plans, deployment slots, and container-based web app hosting
✓Managing compute with Azure CLI, PowerShell, ARM templates, and moving VMs between resource groups

Watch out for

⚠Assuming a VM can be resized to any size without deallocating it first, or that resizing across clusters always succeeds without redeployment.
⚠Confusing Availability Sets with Availability Zones, then expecting zone-level fault isolation from an availability set deployment.
⚠Forgetting that managed disk type changes require the VM to be deallocated, and that some disk conversions are irreversible.

4.0Implement and Manage Virtual Networking

19%

Key concepts

✓Create and configure VNets, subnets, and IP addressing including service endpoints.
✓Configure NSG rules and application security groups to filter traffic.
✓Implement VNet peering, user-defined routes, and Azure DNS zones.
✓Set up private endpoints and Azure Bastion for secure access.

Watch out for

⚠Forgetting that NSG rules are stateful and that default rules allow VNet traffic but deny internet inbound.
⚠Assuming VNet peering is transitive; it is not, so you need UDRs or gateways for spoke-to-spoke.
⚠Overlooking that Azure reserves the first four and last IP address in each subnet.

5.0Monitor and Maintain Azure Resources

14%

Key concepts

✓Configuring Azure Monitor diagnostic settings to route resource logs to Log Analytics, Storage, or Event Hubs
✓Writing KQL queries in Log Analytics to filter, summarize, and aggregate Azure activity and resource logs
✓Creating metric and log search alerts with action groups, plus interpreting alert processing rules
✓Using Network Watcher tools like IP flow verify, connection troubleshoot, and NSG flow logs

Watch out for

⚠Confusing metric alerts with log search alerts, then choosing the wrong alert type for a requirement needing KQL query logic.
⚠Forgetting that diagnostic settings must be enabled per resource before logs appear in Log Analytics, so queries return nothing.
⚠Assuming Azure Backup automatically restores VMs; recovery requires selecting a recovery point and restore type in the vault.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For AZ-104, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

AZ-104 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Manage Azure Identities and Governance

2.0Implement and Manage Storage

3.0Deploy and Manage Azure Compute

4.0Implement and Manage Virtual Networking

5.0Monitor and Maintain Azure Resources

Exam Day Reminders

More AZ-104 resources

AZ-104 Cheat Sheet

AZ-104 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Manage Azure Identities and Governance

2.0Implement and Manage Storage

3.0Deploy and Manage Azure Compute

4.0Implement and Manage Virtual Networking

5.0Monitor and Maintain Azure Resources

Exam Day Reminders

More AZ-104 resources