AZ-104 Microsoft Azure Administrator - Lab & Exam Prep

Compare traditional data center infrastructure with cloud computing, outline the benefits of paying for usage, and highlight Azure's vast services and categories.

Navigate the Azure portal to sign in at portal.azure.com, use the left navigation, blades, and create resources, and use the search bar and pin favorites for quick access.

Manage Azure accounts, subscriptions, and management groups to enforce policies across subscriptions. Assign account administrator, service administrator, and co-administrator roles at the subscription level.

Onboard a fictional organization to Azure by creating an account, selecting a subscription, and building an Azure Active Directory tenant, while exploring subscription and tenant relationships.

Create a new Azure Active Directory tenant named tank cloud.xyz in Australia with the initial domain thank cloud.microsoft.com. Associate this directory with the tank cloud technologies subscription.

Purchase and map a custom domain for Azure onboarding by buying tank cloud.xyz from a registrar and mapping it to the initial domain tank dot on Microsoft.com.

Map a purchased custom domain to your Azure Active Directory tenant by adding DNS records, verifying ownership, and setting it as primary for user emails.

Onboard employees into Azure Active Directory via bulk CSV upload, handle invitations or direct creation, and outline role-based access control (RBAC) in the Azure portal.

Provision role-based access control in Azure portal by assigning built-in roles to specific employees to manage user access, create resources, or restrict actions on storage accounts, networks, and virtual machines.

Organize resources with resource groups as logical containers to manage and move project assets across regions, using tags and portal creation for Nebula, Green Field, and Blue Star.

Create and enforce azure tags and azure policy-based tag policies to classify resources by environment and duration, enforce mandatory values, and auto-append a created on date for compliance.

Provision a Nebula storage account with geo-redundant standard general purpose v2, cool access tier, soft delete for 15 days, and support for table, queue, file share, and blobs.

Provision a container and a data subfolder in an Azure storage account using the portal, creating the logs container and uploading files to the data folder.

Configure external share access to a storage account using rbac or a shared access signature, with read-only permission, a defined date range, and a specific ip.

Apply RBAC in Azure to grant read access for SMB file shares and read, write, delete, and NTFS modify permissions on Azure Storage file shares via IAM.

Configure and automate Azure blob lifecycle management rules to move data from hot to archive after 75 days, optimizing storage costs within a storage account.

Explore Azure storage redundancy levels from locally redundant storage to geo zone redundant storage. Understand copies, locations, durability, availability and region pairing, plus creating storage accounts via Azure CLI.

Create the Nebula prod VNet in Australia East with three subnets for web, app, and DB servers; configure address space and CIDR ranges, and enable VNet peering for hybrid connectivity.

Deploy virtual machines in a virtual network, placing Nebula prod SQL in the db subnet and Nebula Web server in the web subnet, using Windows Server 2019 and basic networking.

Explore how network interfaces (NICs) connect Azure virtual machines to networks and the internet, including creating, attaching, detaching, and configuring primary and secondary NICs with public or private IPs.

This lecture explains configuring Azure network security groups to control inbound and outbound traffic, set rule priorities, and implement an RDP rule from a specific IP while denying internet access.

Connect two or more virtual networks using bidirectional VNet peering to enable secure communication via the Microsoft backbone, with Azure portal setup and route considerations for same-region and global peering.

Enable remote desktop to an Azure VM without a public IP by using Azure Bastion, a browser-based RDP/SSH connection in the portal.

Deploy two Windows 2019 web servers in nebula prod vnet behind a public basic load balancer to distribute traffic; configure a backend pool and health probes.

Learn to configure Azure Application Gateway to route marketing and sales URL requests to Nebula prod one and prod two, using path-based routing and v2 features.

Demonstrates implementing a point-to-site VPN to let work-from-home employees access the Nebula prod VNet using Azure AD credentials and the VPN users group, via a gateway subnet and VNet gateway.

Implement Azure firewall to route all internet traffic from VMs through a firewall with threat protection and threat intelligence, using a route table and rules to block or allow sites.

Use Azure Network Watcher to monitor and diagnose network infrastructure with topology and diagnostics. Test VM connectivity with connection troubleshoot and IP flow verify, adjusting NSGs as needed.

Use Network Watcher to troubleshoot connectivity between entities, such as virtual machines or a virtual machine to a fully qualified domain name or IP, by running a connectivity check.

Use ip flow verify to diagnose connectivity between two virtual machines by analyzing security groups in the virtual network. Check inbound port 3389 status and suggest fixes with network watcher.

Restrict storage account access to a selected virtual network and its subnets using the Azure portal, and understand the private endpoint option for dedicated internal access.

Azure App Service hosts web apps, rest-based web API, and mobile backends with built-in load balancing, auto scaling, deployment slots, and staging slots, and learn plan decisions.

Learn to implement Azure backup service to back up Linux and Windows virtual machines, file shares, and SQL Server instances to a recovery service vault, with point-in-time backups and retention.

Discover how to recover selected VM backup files in the Azure portal, using a restore point and a generated script to mount Nebula web server files.

Learn PowerShell and Azure CLI to manage Azure resources via interactive shells, including browser-based cloud shell, initialize a storage account, and mount a file share.

Discover how PowerShell aliases map dos commands to native cmdlets, use aliases to simplify commands, and prepare to create and manage Azure resources with PowerShell.

Demonstrates PowerShell command structure, parameters, and verb-noun format, then teaches declaring and using variables with the dollar sign, storing command results (objects or lists), and printing or formatting output (tabular).

Explore PowerShell variables continued by printing, piping to format-table, and using select to display specific columns, or index into a collection to access records.

Learn the PowerShell command pattern for Azure resources: use new for create, set for update, and remove for delete, with examples like storage accounts, virtual machines, and virtual networks.

Identify Azure PowerShell commands to create resources like a virtual machine or a storage account. Use autocomplete to find New-AzVM and Get-Command with wildcards to locate New-AzPrivateDnsZone.

Learn to use get-help to explore Azure PowerShell commands, using -examples and -full to view syntax, parameters, remarks, and full documentation for commands like New-AzPrivateDnsZone.

Master PowerShell concepts to prepare for the AZ-104 exam by using ad hoc scripts to manage Azure resources. Learn tips, key commands, and core scripting constructs for efficient Azure administration.

Retrieve arm templates from the Nebula resource group's deployments by opening the resource group blade, then view all past deployment templates in the deployments pane.

Analyze how a shared access signature restricts access to storage account nebula storage three three, two, five, showing that 194.67.124.10 is not in the allowed IP range and is denied.

Configure a Windows VM with a public IP to host a web service and enable on-prem access by creating a security group rule that allows inbound traffic on port 80.

Adopt availability zones to boost uptime by deploying two or more virtual machines across zones in an Azure virtual network to meet a 99.99% SLA.

Determine which users with roles like owner and contributor can add a subnet to the Bangladesh Network virtual network, highlighting role-based access for subnet creation.

Confirm that a user administrator can add a Windows ten device to an Active Directory group without ownership, illustrating feasibility in the AZ-104 Microsoft Azure Administrator course.

learn how a cloud device administrator gains privilege to add a Windows 10 device to an Azure Active Directory group, and perform enable, disable, or delete actions on devices.

Dynamic device membership automatically adds or removes devices in an Active Directory group via dynamic rules, so you cannot manually add a Windows 10 device to that dynamic group.

Explore Azure Disk Encryption features to protect Windows and Linux virtual machines, including BitLocker-based encryption for Windows VMs, Linux VM encryption, and integration with Azure Key Vault.

Evaluate a cost-effective Azure App Service plan to enable backup and restore for a web app; the standard plan supports backups, while premium and isolated plans cost more.

Configure Application Insights to analyze the load time of the Invoice Processing App using the Impact Analysis feature of Application Insights to monitor page performance.

Analyze user retention by using the retention analysis feature in application insights for web applications, measuring returning users of the Marketing Automation App after signup.

Learn to use application insights to analyze user navigation and identify pages where users repeat actions, via the user flows feature that tracks clicks and time spent.

Analyze user engagement in the Marketing Automation App by configuring the Application Insights funnel to track progress from invite to signup, download, usage, and extensive use.

Assess how deploying two Windows-based VMs in an availability set meets the 99.95% availability SLA.

Learn how to use Azure application gateway URL-based routing to direct requests to specific backend pools, such as marketing and sales domains.

Create an Azure CLI script to provision a storage account with kind StorageV2 and sku Standard_GRS, delivering geo-redundant, fault-tolerant storage at low cost for regional outages, for AZ-104 prep.

Azure file sync copies on-premises files to a centralized file share and resolves conflicts by appending the server name to the conflicting file, preserving both versions.

Learn how the Azure import export service migrates terabytes of data by copying to disks, shipping to a data center, and uploading to Azure Files or Azure Blob Storage.

The Azure policy, assigned to the technical group at the dependent route group level, marks Microsoft.Network/virtual networks as not allowed, blocking virtual network creation and VM deployment across the subscription.

Use Azure Network Watcher packet capture to detect and identify network intrusions between virtual networks, with firewalls and virtual machines analyzing ICMP traffic.

Explore backing up managed disks with Azure Backup Vault and Azure Backup Centre. Adopt a policy-driven snapshot lifecycle with fast backup and recovery, no administrative overhead, and minimal cost.

Prepare a backup solution for a critical payroll cloud app by provisioning the Azure resource first, then use the Azure backup service and Azure Recovery Service Wallet to store backups.

Learn how to back up virtual machines to an Azure Recovery Services Vault, focusing on the location prerequisite; in this scenario only the observer VM in US East qualifies.

Deploy a virtual machine from an ARM template, complete the script by providing the deployment type and template file, and select the deployment scope (resource group, subscription, or management group).

Review and fix a command-line script to create an Azure Kubernetes cluster with two nodes and monitoring enabled, adding the missing access value and add-ons.

Review and fix a CLI script to create an Azure private DNS zone, addressing an incomplete script and missing resource type definitions for network private DNS.

Review and fix an Azure CLI script to create a virtual network with address space 11.3.0.0/16 and subnet 11.3.0.0/24, ensuring the script uses the proper network command group.

Complete the cli script to create a storage account at minimal cost by selecting the scale and the locally redundant zone option, standard_belarus.

Practice how to use a CLI to link a virtual network named Claude to the private dns zone Dan Claude. Review and fix a scripted workflow for Azure administration.

Update the nebula network address prefix from 10.1.0.0/20 to include 10.3.0.5 so a VM can receive the private IP address.

Configure the nebula network by adding a new subnet 10.1.2.0/25 so a VM in the virtual network receives a private IP from that subnet, alongside the existing 10.1.0.0/25 range.

Configure the backend pool for a basic load balancer by placing three virtual machines behind it, ensuring they belong to a single availability set or virtual machine skill set.

Configure three virtual machines behind a standard load balancer in a backend pool. Place them in the same virtual network, not requiring an availability set or scale set.

Construct the UNC path for a file share by combining the storage account name cloud storage, the domain blob.core.windows.net, and the share name invoice.

Learn how to move on-premise files to Azure blob storage, including using Azure import for large terabytes and Azure Storage Explorer for direct drag-and-drop into blob folders.

Tag each resource with its department, filter the cost analysis by that tag, and download the usage report to reveal department-wise costs in a multi-department Azure subscription.

Explore cost analysis in the Azure portal to view expenses by resource type across multiple subscriptions. Navigate cost management to locate per-subscription cost insights.

Create an Azure alert triggered by more than three system log error events within an hour by configuring a Log Analytics workspace and setting the alert in Azure Monitor.

Purchase a custom domain, add it to Azure Active Directory, configure public DNS with the domain registrar, and verify the domain in the Azure portal.

Define a custom Azure role in json by adding actions to view all resources and manage support requests, applying least privilege with Microsoft.Authorization/* and Microsoft.Support/*.

Distribute traffic across multiple virtual machines for VPN-connected users using an internal load balancer or Azure Application Gateway.

Configure an internet-facing public load balancer to route requests to frontend web servers, then use an internal load balancer to evenly distribute backend traffic to the application tier.

Learn how to map a custom domain to an Azure-hosted website by selecting DNS record types at the domain registrar, focusing on emacs and the echo.

Enable encrypted on-premise to vnet connectivity by configuring a cloud virtual network gateway and creating a gateway subnet with a /27 address range for Dan Cloud and Vignette Organization.

Configure cross-network DNS name resolution by implementing a DNS server VM and peering the listed virtual networks to let all VMs resolve names.

Determine that a single network security group suffices for six virtual machines in a subnet, since all VMs share identical inbound and outbound rules and IP requirements.

Allocate six network interfaces to provide each of six virtual machines in the subnet with both a private IP address and a public IP address.

Configure an Azure storage lifecycle rule to move objects not modified in the last 30 days in invoice container/files and archive after 90 days, via a JSON script with placeholders.

Identify the internal load balancer type based on a private IP that cannot receive internet traffic and distributes requests to database servers in the back end pool.

Applying a new Azure policy that blocks resource types does not affect existing resources in the Nebula resource group; the virtual machine and networks continue running, while non-compliance is reported.

Deleting the inbound rule allow_50_to_500 blocks ports 50-500, disabling public website access on port 80. Rdp remains available on 3389, but dns on port 53 becomes inaccessible.

Enable autoscaling with an Azure scale set to handle daily spikes from 200 to 800 concurrent users, setting minimum 4 and maximum 16 instances and defining scale-out rules.

Propose a variable packet capture session using Azure Network Watcher to inspect traffic between two virtual machines in a default subnet for four hours, aiding network diagnostics.

Configure Azure Active Directory to allow selected users in the pilot group to join devices, enable device registration with multi-factor authentication, and limit each user to four devices.

Enable session persistence on the load balancer to keep a user's requests on the same web server during the session across four virtual machines on ports eight and 443.

Deploy two virtual machines in the back end pool and use a standard load balancer to reach 99.99% availability.

When a Windows 10 device joins the Azure Active Directory tenant, users in the global administrator role and Azure Active Directory device administrator role, plus the joiner, become local administrators.

Execute a log analytics workspace query to retrieve the average content value, aggregated by the computer, producing a graph with the average counter value on the y-axis.

Explain why moving a vm to a different vnet across regions fails: vm and vnet must be in the same location; delete and recreate the vm in the target region.

Discover how to move an App Service across resource groups, and why a destination group that already hosts an App Service prevents the move due to the documented limitation.

Move the Quest App from tank cloud sales to tank cloud marketing within east coast resource groups; this move between resource groups is feasible, and target group cannot be deleted.

Assess the feasibility of moving an app from tank load staging to tank load prod resource group. Explain that the read-only target prevents the move, illustrating resource group movement rules.

Move a virtual machine between subscriptions using PowerShell by supplying the destination subscription ID and resource group, demonstrating the resource move command for cross-subscription transfers.

Create a network security group and assign it to the finance app subnet, and configure an inbound rule to allow connections on port 4434443 for RDP support.

Use IP Flow Verify in Azure Network Watcher to determine if a specific NSG rule prevents traffic from reaching a virtual machine.

Learn how to use Azure Network Watcher’s Connection Monitor to check outbound connections from a virtual machine to external hosts, essential for meeting event requirements.

Leverage Azure Monitor activity logs to trigger alerts for VM shutdown events across multiple virtual machines in Nigeria, ensuring administrators are notified when any VM shuts down.

Establish a second point-to-site connection to the Azure ritual network, using the vpn client and certificates; export Klein machine one’s certificate as a .pfx and install on Klein machine two.

Learn to configure a point-to-site connection using certificate-based authentication with a self-signed certificate for an Azure network, including downloading the client configuration package and installing the certificate on the vm.

Open the firewall port needed to access an Azure file share over SMB. The SMB file share expense reports requires port 44458 to enable home access.

Assess whether a nic can attach to a vm within the same region and virtual network. The example shows Australia East region but different virtual networks, so attachment isn't possible.

Determines if a new NIC can attach to a VM by ensuring both reside in the same location (Australia East); resource group location is metadata and not a constraint.

Create a custom role from the built-in virtual machine contributor using a PowerShell script. Identify the missing get role definition and new role definition commands to complete the script.

Master PowerShell steps to add a 148 GB data disk to a VM by creating a disk configuration, provisioning the disk, retrieving the VM, attaching, and updating the VM.

Deploy an application gateway with a web application firewall to distribute frontend traffic across backend VMs and protect the frontend web server from malicious attacks.

Determine who can assign the reader role in a cloud network by examining privilege levels in Active Directory; only the honor roll, a highly privileged role, can grant access.

Assign role-based access control for a storage account by assigning the storage account contributor, storage blob data contributor, and storage blob data owner roles to specific groups.

Grant Jack Smith network contributor access at the Web Apps IDG resource group to manage the public and internal load balancers, following the principle of least privilege.

Choose general purpose v2 storage to support uploading images and videos, archive data storage, and file share while ensuring data availability during regional outages in a cost-effective solution.

Recommend geo-redundant storage with replication to a secondary region to ensure file share, images, and videos, plus archive data, stay available during regional outages with failover, at a cost-effective price.

Determine the required availability sets in Azure to achieve 99.5% SLA for two web VMs and two database VMs by using one availability set per tier, totaling two.

Learn to record all successful and failed connections to a virtual machine using Azure Network Watcher flow logs, after registering the Microsoft DOT Insights provider and creating a storage account.

Direct RDP traffic from the load balancer to a specific RDP VM behind it by configuring an inbound NAT port forwarding rule, enabling precise traffic routing across the farm.

Restore a backup from the Azure backup service into a destination virtual machine by installing the Microsoft Recovery Service Agent on the target VM and preparing the Accent Processing Server.

Learn to restore a Windows Server 2016 VM from Azure Backup using the replace existing option, which replaces the VM's disk with the backup after stopping the VM.

Apply an Azure subscription-level policy to restrict virtual machine creation to a specific size and SKU, ensuring only approved configurations are deployed.

Configure a route table to route traffic from other networks through the intrusion detector VM and enable IP forwarding on the VM's network interface.

Learn how to route network traffic through a specific virtual machine by adding a custom route in the route table to force traffic through an intrusion detector VM.

When the on-prem public IP changes, remove and recreate the site-to-site VPN connection to Azure to maintain connectivity with minimal downtime, without deleting the VPN gateway.

Investigate why a security administrator does not see security questions during self-service password reset. Explain how admin password reset policies differ from standard users and how this affects SSPR prompts.

Review the AZ-104 self-service password reset policy for report reader roles; this user will be prompted for security questions, while administrators bypass questions through two-factor authentication.

Enable soft delete for blobs on the Nebula Storage 3672 storage account to guard against accidental deletion and set a 15-day retention period in the data protection settings.

Learn to access a storage account from a virtual network using virtual network service endpoints with private IP, and why shared access signatures are less suitable for internal use.

Learn how to configure a storage account to be accessible from a specific IP address range in Azure, using the networking settings and shared access signatures.

Determine which storage accounts support the archive tier, focusing on general purpose v2 and blob storage, as illustrated by the listed cloud storage accounts in the AZ-104 course.

Configure Azure File Sync to replicate an on-premise file server to Azure by installing the Azure File Sync agent, registering the server, and adding the server endpoint.

Start the Azure virtual machine to obtain its dynamic IP, review the network security group and inbound rules, and enable a remote desktop connection to the VM.

Troubleshoot inter-virtual network traffic by using the IP flow verify tool to pinpoint which network security group rule blocks ICMP traffic after VNet peering.

Troubleshoot attaching a secondary network interface to a running Azure VM by stopping the VM first, then attach the new interface to enable network connectivity.

Ensure the NIC and VM reside in the same region; cross-region attachment is not supported. Create a NIC in Australia East and attach it.

Assess whether two windows VMs in a skill set meet 99.95% SLA. The caption notes that a skill set alone won’t meet SLA; spread across two or more file domains.

Explain how an enforced policy prevents updating virtual networks in a resource group, blocking adding an address space.

Learn how to form the url to access a blob in a storage account by combining the account, container (invoice), and blob name (May Invoice).

Assess that net use cannot connect to a SAS-protected Azure file share, even when the client IP matches the allowed range.

Use a single virtual network with three subnets: web tier, application tier, and database tier to deploy a multi-tier web app.

Demonstrate VNet peering enabling ICMP ping between networks, with firewalls on VMs allowing ICMP, and show bidirectional pairing between VM1 and VM3.

Verify Azure VNet peering by checking source and destination networks and confirming if peering exists in the correct direction. Assess VM firewall rules allowing ICMP traffic to ensure connectivity.

Explore which virtual networks can peer by verifying that address spaces do not overlap; for example, VNet1 can peer with VNet3 and VNet4 when their address spaces are non-overlapping.