AZ-104 Cheat Sheet: Every Domain, Every Key Service, One Page

AZ-104 Exam Facts at a Glance

Before diving into the domains, memorize these critical exam facts. They are often the first questions in the exam or used in scenario-based questions.

• Number of questions: 40-60 questions
• Time limit: 120 minutes (plus additional time for non-native English speakers if applicable)
• Format: Multiple choice, multiple select, drag-and-drop, and case studies. You cannot go back to previous questions in some question sets.
• Passing score: 700 out of 1000
• Cost: $165 USD (varies by region)
• Validity: 1 year from the date of passing (requires renewal)

Exam Domains and Weightings

Knowing the weight of each domain helps you prioritize your study time. The AZ-104 exam has five domains: Looking for more detail? See GCP Associate Cloud Engineer Cheat Sheet: Services, IAM and Networking on One Page.

Focus more on networking and compute, but don't neglect the other domains.

To turn that focus into a week-by-week schedule, use the free AZ-104 study plan that builds a prep timeline around the official domain weights.

Domain 1: Manage Azure Identities and Governance (15-20%)

This domain covers Azure AD, role-based access control (RBAC), and governance. Key concepts include: For background on this area, read GCP Professional Cloud Architect Cheat Sheet: Architecture Decisions at a Glance.

• Azure AD: Understand users, groups, and service principals. Know how to create and manage users and groups, including bulk operations.
• RBAC roles: Know the difference between Owner, Contributor, Reader, and User Access Administrator. Remember: Owner can assign roles, Contributor cannot.
• Azure Policy: Use policies to enforce compliance. Know the difference between policy and initiative definitions.
• Resource locks: Apply ReadOnly or Delete locks to prevent accidental deletion or modification.
• Management groups: Organize subscriptions into a hierarchy for policy and cost management.
• Azure AD Conditional Access: Understand how to enforce MFA and other conditions for access.
• Privileged Identity Management (PIM): Just-in-time access for elevated roles.

Domain 2: Implement and Manage Storage (15-20%)

Storage accounts, blobs, files, and data replication are central here. Key points:

• Storage account types: General-purpose v2 (most common), BlobStorage, FileStorage, BlockBlobStorage.
• Replication options: LRS (locally redundant), ZRS (zone-redundant), GRS (geo-redundant), RA-GRS (read-access geo-redundant). Know the difference: GRS provides failover to secondary region, RA-GRS allows read access to secondary.
• Blob access tiers: Hot, Cool, Archive. Archive is for rarely accessed data and has a 30-day minimum storage duration.
• Azure Files: Managed file shares using SMB and NFS protocols. Know how to create file shares and mount them.
• Storage security: Use Shared Access Signatures (SAS) for delegated access. Know the difference between account SAS and service SAS.
• Azure Storage encryption: All data is encrypted at rest by default (Storage Service Encryption).
• Lifecycle management: Automate tier transitions using lifecycle policies (e.g., move to Cool after 30 days).

Domain 3: Deploy and Manage Azure Compute Resources (20-25%)

This domain covers VMs, App Services, containers, and Azure Functions. Focus on:

• Virtual Machines: Know VM sizes, availability sets, availability zones, and scale sets. Understand how to configure high availability.
• VM storage: Managed disks vs unmanaged disks. Know the different disk types: Ultra, Premium SSD, Standard SSD, Standard HDD.
• Azure App Service: Deploy web apps, API apps, and mobile backends. Understand App Service plans and scaling (scale up/out).
• Containers: Azure Container Instances (ACI) for simple containers, Azure Kubernetes Service (AKS) for orchestration.
• Azure Functions: Serverless compute. Know triggers and bindings, and the difference between consumption and premium plans.
• Azure Virtual Desktop: Virtualized Windows desktops and apps.
• ARM templates: Infrastructure as code. Know how to deploy resources using templates.

Domain 4: Configure and Manage Virtual Networking (25-30%)

Networking is the heaviest domain. Master these concepts: Another useful resource: AZ-104 in 8 Weeks: Study Plan for Azure Administrators.

• VNet and subnets: Plan IP address spaces. Know the difference between address space and subnet.
• Network Security Groups (NSGs): Filter traffic with rules. Understand priority and default rules.
• Azure Firewall: A managed cloud firewall. Compare with NSGs (NSG is distributed, Firewall is centralized).
• Azure Load Balancer: Layer 4 load balancing. Know the difference between public and internal load balancers.
• Application Gateway: Layer 7 load balancing with URL-based routing and SSL termination.
• Azure DNS: Domain hosting and resolution. Understand record types.
• VPN Gateway: Site-to-site and point-to-site connections. Know the difference between policy-based and route-based.
• ExpressRoute: Dedicated private connection to Azure. Not over the internet.
• Peering: VNet peering (same region) and global VNet peering (cross-region).

Domain 5: Monitor and Maintain Azure Resources (10-15%)

This domain is about monitoring, backup, and compliance. Key areas:

• Azure Monitor: Collect and analyze metrics and logs. Know the components: Application Insights, Log Analytics, and Alerts.
• Azure Service Health: Tracks service issues and planned maintenance.
• Azure Advisor: Provides recommendations for cost, performance, reliability, and security.
• Backup and Recovery: Azure Backup for VM and file backups. Azure Site Recovery for disaster recovery.
• Azure Policy: Already covered in Domain 1, but also used for monitoring compliance.
• Resource groups: Know how to move resources between groups and subscriptions.

Common Exam Traps and Gotchas

Here are the classic pitfalls that trip up candidates:

• RBAC vs Azure Policy: RBAC controls who can access resources (permissions), Azure Policy controls what resources can be created (compliance). Don't mix them up.
• Locks vs RBAC: Locks apply to all users, even Owners. RBAC is permission-based.
• Storage replication: GRS provides failover, but you cannot read from the secondary region unless you enable RA-GRS. Also, the failover is automatic only for GRS with RA-GRS? Actually, GRS provides automatic failover, but RA-GRS allows read access to secondary.
• Availability Sets vs Availability Zones: Availability sets protect against hardware failures within a datacenter (rack-level), Availability Zones protect against datacenter failures (region-level).
• NSG vs Azure Firewall: NSGs are for subnet/network interface level filtering, Azure Firewall is for centralized network protection. Both can be used together.
• Load Balancer vs Application Gateway: Load Balancer works at Layer 4 (TCP/UDP), Application Gateway at Layer 7 (HTTP/HTTPS).
• Scale sets vs Availability Sets: Virtual Machine Scale Sets provide auto-scaling and load balancing, Availability Sets only provide high availability.
• Azure AD vs Azure RBAC: Azure AD is for identity, Azure RBAC is for authorization to Azure resources.
• Backup vs Site Recovery: Azure Backup is for backup (point-in-time recovery), Site Recovery is for disaster recovery (replication and failover).

Practise until the exam format feels routine — start with Microsoft Azure Administrator (AZ-104) exam questions.

Before or after that, take the free AZ-104 readiness check to see which domain needs the most review.