CertKata

Microsoft Certified: Azure Administrator Associate — Free Essentials

Key facts distilled from CertKata's AZ-104 question bank. Free to read — no account needed.

The scope hierarchy, and what inherits down it

Management groups sit above subscriptions, so a policy or role assignment made once there is inherited by every subscription beneath. A working shape is management groups by department, containing subscriptions by environment, containing resource groups by workload - which lets each control be applied at the level it actually belongs to. Both Azure Policy assignments and RBAC role assignments can be scoped precisely to a single resource group, granting exactly the intended reach instead of a broader administrative role over the subscription.

Redundancy: what each level survives

Region and availability zone hierarchy: a region contains multiple availability zones, each backed by one or more data centersREGIONAZ-1Data centerData centerAZ-2Data centerData centerAZ-3Data centerData centereach AZ: one or more independent data centers

LRS protects only against a drive or node failure inside one datacenter. ZRS replicates synchronously across availability zones within the Region, surviving the loss of a whole zone while keeping data in-Region. GRS adds a copy in a secondary Region, but that copy is not readable until a failover actually happens; RA-GRS is the variant that allows reads from the secondary at all times, including while the primary is healthy. RA-GZRS combines zone redundancy in the primary Region with geo-replication and always-on secondary reads - the strongest of these against losing a Region outright.

Availability sets, zones and platform recovery

An availability set spreads VMs across fault domains, meaning separate physical hardware, and update domains, meaning separate maintenance windows - but all within one datacenter. Availability zones instead spread across physically separate zones, which is what protects against losing a whole datacenter. A VM's zone is fixed at creation and generally cannot be changed live, so moving it means redeploying into the target zone rather than migrating in place. Separately from either, Azure detects host-level hardware failure and redeploys the affected VM onto healthy hardware automatically, for standalone VMs as well as scale set instances.

RBAC roles, and what Contributor withholds

Contributor grants full management of resources but explicitly not the ability to grant access to anyone else; Owner adds exactly that, which is usually the capability you mean to withhold. When no built-in role matches, a custom role definition names precisely which actions are allowed and denied. For cost visibility alone, a billing or cost reader role gives the data without any resource-management rights. Assign roles to a group rather than to fifty individuals - membership changes then adjust effective access with no role assignment touched.

NSGs, ASGs and effective rules

An NSG applies allow and deny rules in priority order at subnet or NIC level, which is how default-deny with explicit allow is built. A subnet may have at most one NSG associated with it, though a network interface can carry its own as well, and both then apply - which is why the effective security rules view matters: reading only one layer risks missing a rule genuinely in force from the other. Application security groups let rules reference a logical group such as 'web servers' by role instead of by IP, so one rule change covers every member. PaaS resources often add their own firewall, layered alongside rather than instead of an NSG.

This is a preview. Get the full AZ-104 cheat sheet — every domain, bundled with the practice question bank.

Sign up for the full version