AZ-104 Microsoft Azure Administrator w/ AZ104 Practice Tests

Learn how on-premises Active Directory creates user identities and authenticates access to company resources, using a domain like abc.com, and how Azure Active Directory serves as the cloud authentication layer.

Discover how Azure Active Directory has been renamed to Microsoft Entra ID and how to locate the new name in the portal.

Azure Active Directory is a cloud-based identity service that authenticates users for portal.azure.com and cloud apps, using tenants as instances and primary or custom domains for user IDs.

Explore licensing options for Microsoft Entra ID (Azure Active Directory), from free to premium (P1, P2), including 100 free licenses for 30 days and conditional access differences.

Explore how Azure Active Directory uses a default dot on microsoft.com, and how to add and verify a custom domain (TXT or MX) to enable user names like user@yourdomain.com.

Examine how to verify a Contoso.com custom domain in Azure Entra ID using DNS records, noting that you can create MX or TXT records for domain verification.

Learn how to configure self-service password reset (SSPR) in Azure Active Directory, including premium licensing with a minimum P1 (P2 trial), and enabling it for groups rather than individuals.

Understand hybrid identity by syncing on-premises active directory to azure active directory, enabling access to apps via azure ad connect and azure ad connect cloud sync, and self-service password reset.

Learn how self-service password reset (SSPR) works in a hybrid Azure AD environment, including group-based registration, P1 licensing, supported authentication methods, and password write back.

Configure Azure AD users and groups, create single and bulk users, and assign access with security or Microsoft 365 groups. Understand assigned versus dynamic membership and P1 license requirements.

Explore dynamic user membership and query syntax to build a Microsoft 365 group rule with two conditions: location equals India and department equals security, using and/or operators.

Learn to collaborate with external organizations by inviting guest users in Azure Active Directory, sending invitations, and accepting them to enable B2B collaboration without creating a user.

Learn how to resolve guest user invitation errors in Azure AD by enabling external collaboration settings to allow inviting external guests.

Learn how Azure AD administrative units create logical boundaries between locations, enabling region-specific admins to manage only unit members with a user administrator role, limited by P1/P2 licensing.

Learn how administrative units define scope in Azure AD by adding groups versus direct members, and how to grant local admins by creating administrative units as logical boundaries.

Discover how Azure regions group data centers into geographic areas connected by low-latency networks. Explore availability zones, regional pairs, and sovereign regions for resilience and disaster recovery.

Create an Azure free account to use Azure services. A subscription is a billing agreement enabling deployment of resources like virtual machines and SQL databases via the portal.

Discover what a free subscription includes, like a $200 credit for 30 days and 12 months of free services. Learn to view subscriptions and perform cost analysis in Azure.

Learn to monitor and optimize azure costs using cost management and billing tools, analyze per-resource spend, and distinguish budgets from spending limits with notification versus automatic service shutdown.

Organize Azure management infrastructure by linking a subscription to resource groups and resources. A resource group acts as a container where resources reside, can span regions, and move between groups.

Explore how a subscription hosts resources while Azure AD handles authentication, and how a tenant and RBAC roles like global administrator and application administrator relate subscriptions to Azure AD.

Compare Azure RBAC and Azure AD roles to control access, noting that subscription-level roles inherit to all resources and that resource group level access limits scope.

Organize multiple Azure subscriptions into a management group to simplify access control, policies, and compliance across all resources in your tenant.

Apply resource locks at subscription, resource group, or resource level to prevent accidental deletion or modification; use delete or read-only locks to protect resources and their children.

Explore how Azure policy enforces organization standards and compliance at scale by restricting resource creation to allowed locations, such as United States regions, and enforcing mandatory tags.

Design an Azure virtual network, allocate a private ip range within address space and subnets, and attach a virtual machine to obtain a private ip while learning public ip usage.

Explore how network security groups filter inbound and outbound traffic with a five-tuple, and how attaching NSGs to a VM NIC or a subnet (or both) controls access.

Evaluate inbound traffic by applying subnet NSG first, then NIC NSG; a subnet 3389 allow can be blocked by a VM-level deny, while outbound checks NIC first, then subnet.

Provision a Windows VM inside the existing virtual network subnet (10.0.0.0/24) and automatically create a public IP, a network interface card, and an OS disk for Windows Server 2019.

Learn to create a Windows virtual machine in Azure, selecting subscription, resource group, East US region, DS1V2 size with premium OS disk and a public IP, then apply production tags.

Connect to an Azure virtual machine via remote desktop protocol (RDP) using the public IP from the network interface, and configure the network security group to allow 3389 inbound traffic.

Connect to the virtual machine with PowerShell, install the web server, and configure port 80 access to display the default page from inetpub www root.

Learn how to connect two Azure virtual networks across regions using private IPs through virtual network pairing, with portal setup steps and testing via two virtual machines.

Create application security groups to logically cluster VMs, then use NSG inbound rules with ASG destinations to control ports like 80 and 1433.

Discover how a load balancer distributes traffic across back end servers using front end and back end IPs, health probes, rules, and availability set, with basic and standard skews.

Install IIS on two VMs in an availability set behind a basic Azure load balancer using PowerShell, open port 80 in NSG, and validate traffic distribution.

Configure a public basic load balancer, add two VMs to the backend pool, configure front-end IP, health probes, and validate load distribution across VMs.

Understand session persistence in load balancers, using client IP or client IP and protocol to route a user to the same backend instance, via hash-based distribution.

Describe how inbound NAT rules in an Azure load balancer forward front-end traffic to back-end virtual machines, mapping a front-end port like 500 to RDP port 3389.

Explore Azure application gateway, a layer 7 load balancer that reads http headers and url paths to enable path-based and multi-site routing to backend pools, app service, or on-prem servers.

Explore the application gateway components—listener, routing rules, sdp setting, and the backend pool—and learn how requests traverse to the backend via a listener that matches port, protocol, host, and IP.

This lecture explains why virtualization evolved to containers like Docker, showing how three web apps can run in lightweight containers instead of full VMs, using the underlying kernel.

Distinguish containers from virtual machines, noting containers share the host OS via Docker, while VMs run OSes. Set up ubuntu VM, install Docker, and create containers in a virtual network.

Understand Docker architecture with the client (Docker CLI) and the daemon, and see how docker run nginx triggers a REST API call to fetch images from Docker Hub.

Deploy an ubuntu virtual machine in Azure, connect via SSH, and install Docker quickly with the official install script, then verify Docker version.

Docker images provide the operating system file system, your application, and dependencies as a blueprint for creating containers, fetched via docker pull from Docker Hub and run by the daemon.

Create and run docker containers with the nginx image, map host ports 8080 and 8081 to container port 80, and access via a public IP after NSG rules.

Compare containers with Azure Container Instances; learn to deploy containers directly to Azure without managing virtual machines or Docker installations, using Docker Hub images like nginx.

Azure App Service is a platform as a service for hosting web applications with managed compute resources, so you don't manage VMs and can choose runtime stacks.

Create an Azure web app with app service, select resource group and domain, compare ASP.NET on Windows with dotnet core on Linux or Windows, and review app service plan tiers.

Explore deployment center and deployment slots in Azure, connect apps to repositories like GitHub, deploy automatically, use staging slots, swap to production, and test features safely.

Learn to install and use the Visual Studio community edition to build a dotnet ASP.NET core web app, customize templates, and deploy it to Azure App Service.

Discover how Azure app service plans on windows and Linux determine runtime compatibility for web apps, including dotnet core, ASP.NET, Java, Python, PHP, and node versions.

Explore Azure Bastion, a fully managed jump service that connects to private VMs via RDP and SSH over 443 without exposing them, using a dedicated bastion subnet.

Learn to implement an Azure availability set by distributing your app across multiple virtual machines for better availability and SLA. Understand fault domains, update domains, and planned maintenance.

Explore availability zones as a high availability solution that protects against data center failures by spreading VMs across separate zones with independent power, cooling, and networking, delivering a 99.99% SLA.

Examine how NSGs control traffic in a VNet with subnet-level and VM-level rules, showing inbound checks subnet before VM and outbound checks VM before subnet.

Azure Firewall is a stateful, highly available service with cloud scalability, offering threat intelligence filtering and Azure Monitor logging within a hub-and-spoke topology using a dedicated firewall subnet and policies.

Connect Azure virtual networks to on-premises environments via vpn (point-to-site, site-to-site, vnet-to-vnet) or express route, and explore vnet peering on the Microsoft backbone.

Learn how point-to-site VPN lets individual clients securely connect to Azure virtual network via a VPN gateway, using certificate-based authentication with root and client certificates and IKEv2 OpenVPN SSTP protocols.

Configure a point-to-site VPN by creating a virtual network gateway, gateway subnet, and public IP to connect your on-premises VNet with an Azure VNet.

Configure a point-to-site VPN by creating a tunnel from an on-premises VM to the Azure vnet via the virtual network gateway, using IKEv2 or OpenVPN SSL with cert-based authentication.

Generate and export self-signed root and client certificates with PowerShell, manage them in Windows certificate manager, and configure a point-to-site VPN to access an Azure VNet using a VPN client.

Learn site-to-site vpn architecture in Azure, using a VM as a routing server on premises and a vpn device, plus local network gateway to represent your on-prem network.

Set up a site-to-site vpn by deploying a routing server VM, installing remote access role, and configuring a local network gateway in Azure with on premises ip and address space.

Configure a site-to-site VPN between on premises and Azure VNet by deploying a routing server, creating the local network gateway, and establishing the connection with a shared key.

Enable gateway transit to reuse a peered virtual network gateway for spoke networks to access on premises via site-to-site VPN. Learn hub and spoke configuration, gateway transit, and routing.

Configure Azure private DNS zone to map VM names like vm1.contoso.local to IPs, using record sets within virtual networks; compare public DNS hosting with registrar domains.

Identify resource providers as adapters enabling services like virtual machines and storage accounts. Learn how resource ids are built from subscription, resource group, provider, and resource name.

Explore Arm template deployment modes, including incremental and complete, and learn how incremental preserves existing resources while complete deletes those not defined in the template, with template file usage.

Explore exam questions on ARM templates and PowerShell, including creating a virtual machine scale set, exporting a resource group template, and redeploying resources with complete mode considerations.

Learn to register a resource provider through PowerShell using the register-az resource provider command with the provider namespace, enabling resources such as Microsoft.Compute.

Understand infrastructure as code in Azure by provisioning resources like SQL databases and VMs through code, comparing JSON ARM templates with Bicep templates and migration reasons.

compare bicep template structure with arm json templates, highlighting concise syntax and essential keywords like resource, param, var, and symbolic name for storage accounts.

Create a storage account using a bicep template in Visual Studio Code, with the bicep extension for intellisense, then deploy it in the Azure portal to East US.

Deploy a storage account by using a bicep template via PowerShell or CLI, after installing the Azure module and connecting to your subscription; the bicep transpiles to json ARM template.

Discover how to securely store passwords, certificates, cryptographic keys, and API keys in Azure Key Vault, manage access with RBAC, and reference secrets in ARM templates.

Learn how to reference a key vault secret inside an arm template, encrypt passwords in the parameter file, and build the resource id with subscription, resource group, and secret name.

Azure backup provides a simple, secure, cost-effective way to back up Azure and on-premises data via the recovery services vault and agents for files or whole virtual machines.

Create a recovery services vault and enable backup for Azure VMs, using a daily 3:30 p.m. UTC policy with 30-day retention, and learn snapshot and instant restore.

Learn to verify backups in the recovery services vault, understand snapshot and recovery points, and perform file recovery on a VM using restore points and a PowerShell script.

The soft delete feature in recovery services vault keeps deleted backups for 14 days by default and can be extended to 180 days, with default enabled and can be disabled.

Learn to delete backup data in Azure, stopping backups and using soft delete for a 14-day retention. Undelete restores protection; permanently delete data after the retention period.

Answer exam-style questions on Azure backup: perform file-level recovery via mount points and PowerShell, and manage retention, soft delete, and vault deletion prerequisites.

Explore how Azure Monitor collects telemetry from apps with Application Insights, stores logs and metrics in a Log Analytics workspace, and uses alerts and visualizations to monitor and secure resources.

Collect logs from a virtual machine using data collection rules and the Azure Monitor Agent to send Windows event logs to a Log Analytics workspace.

Discover how to query logs in the log analytics workspace using kusto query language, filter event data with where clauses, and compare kql to sql in azure monitor.

Azure Monitor alerts enable proactive detection by configuring alert rules with scope, signal, and conditions, and routing notifications through action groups to emails and ITSM tools.

Explore Azure Monitor alerts by examining an alert rule with email and SMS actions and the per-hour service limits of 100 emails and 12 SMS.

Learn how network watcher monitors Azure networking health with topology visualization, connection monitor for end-to-end latency, and diagnostic tools like IP flow verify and NSG analysis.

Explore Azure storage, a massively scalable cloud storage via a storage account with a globally unique namespace, offering blobs, tables, queues, and file shares, plus standard and premium tiers.

Explore Azure storage redundancy options to protect data, including LRS, ZRS, GRS, and GZRS, across a single data center, multiple availability zones, or paired regions with SLA implications.

General purpose v2 storage accounts support blob, file, queue, and table services; create containers to store blobs, upload files, and manage access with urls.

Explore the Azure Storage Explorer, a graphical interface for managing storage across Windows, Mac, and Linux, enabling sign-in, upload, download, and copy with permissions.

Learn to use the easy copy azcopy tool to copy blobs and files between storage accounts, configure path environment, authenticate with Azure Active Directory, and run via PowerShell.

Learn about storage access tiers—hot, cool, and archive—and how each tier affects pricing, including storage, transaction costs, and egress, with practical guidance on changing tiers in the Azure portal.

Explore immutable blob storage in Azure: configure time-based and legal hold policies at the container level to prevent deletion or modification of critical data.

Automate moving blobs within Azure blob storage to the cool tier after 30 days using lifecycle management rules, applying at container or blob level to save costs.