AZ-104 · Administration test

Azure RBAC assignments are additive and inherited down the scope hierarchy. Contributor at resource-group scope grants that role's actions while Reader remains inherited.

Azure Policy evaluates resource configuration and can audit, deny or remediate depending on the effect.

CanNotDelete allows authorized changes but blocks deletion. ReadOnly also blocks updates.

Tags are not inherited automatically from resource groups or subscriptions. Azure Policy can add or inherit tags.

SSPR allows users to reset or unlock accounts after verification through configured authentication methods.

A constrained SAS limits time, permissions, resource and optionally IP/protocol. Account keys are much broader.

GZRS replicates synchronously across primary-region zones and asynchronously to a secondary region. RA adds read access to the secondary.

Lifecycle management can tier or delete blobs based on age and filters.

Blob versioning automatically preserves a prior version after modification or deletion. Soft delete can add further protection.

AzCopy is a command-line utility optimized for transfer to and from Azure Storage.

Bicep compiles to ARM and describes desired state. Resource Manager performs an idempotent deployment where resource operations support it.

Availability zones are physically separate zones in a region with independent power, cooling and networking.

VM Scale Sets manage groups of VM instances and integrate with autoscale based on metrics or schedules.

Container Instances runs containers without managing VMs or an orchestrator and fits simple isolated jobs.

Deployment slots provide separate live environments. Swap warms the new version and rollback is another swap.

VNet peering is not transitive. A-to-C traffic needs direct peering or a planned transit/routing solution.

NSG rules evaluate in ascending priority number. The first match wins, so 200 precedes 300.

A private endpoint is a network interface with a private subnet IP for the PaaS resource. Service endpoints do not give the resource a private subnet IP.

Service endpoints extend VNet identity to the PaaS public endpoint. Private Link exposes the service through a private VNet address.

Azure Bastion provides managed RDP/SSH access over private IP without public IPs on the VMs.

An internal load balancer uses a private frontend IP and distributes TCP/UDP traffic to private backends.

The alert rule defines signal and threshold. The action group defines recipients and automated actions.

Log Analytics uses Kusto Query Language to filter, aggregate and correlate log data.

Backup provides recovery points. Site Recovery focuses on continuity through replication and orchestrated failover/failback.

Connection Monitor measures connectivity, latency and reachability between sources and destinations over time.