Luyện thi Azure Administrator AZ-104

Microsoft Entra ID, formerly Azure Active Directory, provides identity, authentication, and authorization for users and applications. DNS, Firewall, and Policy serve other purposes.

Azure RBAC assigns roles such as Owner, Contributor, and Reader to principals, controlling what they can do on resources. NSGs filter network traffic, and Firewall protects the network.

Owner can manage resources and assign roles. Contributor can manage resources but cannot assign roles, Reader has read-only access, and User Access Administrator can only manage access.

Azure Policy evaluates resources and enforces rules such as allowed locations, naming, and tagging. Monitor observes health, Backup protects data, and Traffic Manager routes DNS traffic.

Management groups sit above subscriptions and let you apply policies, RBAC, and cost controls across many subscriptions. They do not store disks, filter traffic, or run workloads.

PIM gives eligible users temporary, time-bound privileged roles and requires approval or justification when needed. SSPR resets passwords, and Identity Protection detects risky sign-ins.

A tenant is a dedicated Microsoft Entra ID directory that represents an organization. VNets, storage accounts, and resource groups are Azure resources, not identity directories.

Conditional Access policies can require MFA, device compliance, or other conditions before sign-in. Advisor gives recommendations, Cost Management tracks spend, and Resource Graph queries resources.

A subscription is a billing and access boundary that contains resource groups and resources. DNS zones, VNets, and vaults are resources within a subscription.

A resource group is a logical container that holds related resources so they can be managed, monitored, and deleted together. It is not an identity group or a network object.

The Activity log records control-plane events such as create, update, and delete actions. Diagnostic logs capture resource-level activity, and sign-in logs capture authentication events.

Reader lets users view resources and settings but not change them. Contributor can manage resources, Owner can also assign roles, and there is no built-in Administrator role in RBAC.

Blob Storage stores unstructured objects such as documents, images, and backups. Table Storage is NoSQL, Files provides SMB shares, and Queue Storage stores messages.

The Hot tier has the highest storage cost but the fastest access for frequent use. Cool is for infrequent access, Archive is the lowest cost with long retrieval times, and Premium is for high-performance block blobs.

Archive offers the lowest storage cost and is intended for data accessed rarely, with retrieval that can take hours. Hot and Cool offer faster access at higher storage cost.

Azure Files provides managed SMB and NFS file shares in the cloud. Blob is object storage, Queue is messaging, and Disk Storage provides virtual hard disks for VMs.

Table Storage offers a schemaless NoSQL key-value store. SQL Database is relational, Cosmos DB is a multi-model NoSQL database, and Data Lake stores large analytics files.

A SAS grants scoped, time-limited access to storage without exposing the account key. It is not permanent, and it does not create DNS records or firewall rules.

Storage Service Encryption encrypts data at rest automatically using Microsoft-managed or customer-managed keys. Firewall, Private Link, and NSGs control network access, not encryption.

GRS replicates data asynchronously to a paired secondary region for disaster recovery. LRS keeps multiple copies in one data center, and ZRS replicates across zones in one region.

LRS replicates data three times within a single data center and has the lowest cost. GRS and RA-GRS add a secondary region, and ZRS adds zone redundancy.

AzCopy is optimized for high-performance data transfer to and from Azure Storage. PowerShell manages Azure broadly, kubectl manages Kubernetes, and sqlcmd works with SQL Server.

Azure SQL Database is a managed relational database service with automated backups, patching, and high availability. Blob, Table, and Queue Storage are not relational databases.

StorageV2 is the general-purpose account that supports blobs, files, queues, and tables. BlobStorage and BlockBlobStorage support only blobs, and FileStorage supports only files.

Azure Virtual Machines gives you managed IaaS VMs with full control over the operating system. Functions and Container Instances are serverless, and App Service is PaaS for web apps.

VMSS runs a group of identical VMs and can autoscale instance count based on metrics. Availability Sets improve fault tolerance, Load Balancer distributes traffic, and Traffic Manager routes DNS.

ACI runs individual containers on demand without managing VMs. AKS manages a Kubernetes cluster, VMSS manages VMs, and App Service hosts web apps.

AKS is a managed Kubernetes service for deploying and scaling containerized applications. ACI is for single containers, Service Fabric is a microservices platform, and Batch runs parallel jobs.

Azure Functions is a serverless compute service that runs code in response to events. VMs and Dedicated Hosts require server management, and Availability Sets organize VMs.

Azure Virtual Desktop delivers a managed Windows desktop and application experience in Azure. Bastion provides secure RDP/SSH access, and App Service hosts web apps.

An availability set spreads VMs across fault domains and update domains within one data center to improve uptime. It does not protect against region-wide outages, key leaks, or DNS failures.

An availability zone is a physically separate data center location within a region, with independent power, cooling, and networking. Resource groups and DNS zones are logical objects.

Azure Load Balancer operates at Layer 4 for TCP and UDP traffic. Application Gateway handles HTTP/HTTPS at Layer 7, Traffic Manager does DNS-based global routing, and Front Door is a global HTTP load balancer.

Application Gateway is a Layer 7 load balancer for HTTP/HTTPS with features such as URL-based routing and WAF. Load Balancer is Layer 4, VPN Gateway connects networks, and DNS resolves names.

Premium SSD provides high throughput and low latency for production workloads. Ultra Disk offers the highest performance, but Premium SSD is the common low-latency choice; Standard SSD and HDD are lower cost.

App Service is a PaaS offering for web apps, APIs, and mobile backends with built-in scaling and security. VMs are IaaS, ACI runs containers, and Functions is serverless event compute.

A VNet provides isolated, private networking in Azure for resources such as VMs, databases, and app services. It does not store disks, manage identities, or enforce backups.

A subnet divides a VNet address space into segments, allowing separate routing and security for groups of resources. It is not a backup, DNS record, or resource group.

Azure DNS hosts DNS zones and records and resolves names using Azure infrastructure. Traffic Manager routes based on DNS policies, Front Door is a CDN/load balancer, and Private Link provides private connectivity.

An NSG contains security rules that allow or deny inbound and outbound traffic based on source, destination, port, and protocol. Policy enforces governance, not traffic filtering.

WAF protects web apps from OWASP Top 10 attacks such as SQL injection and cross-site scripting. Azure Firewall is a network firewall, Bastion provides secure VM access, and Private Link is private connectivity.

VNet peering connects two VNets through the Azure backbone so resources can communicate privately. DNS resolves names, Public IP exposes endpoints, and Network Watcher diagnoses network issues.

VPN Gateway creates encrypted site-to-site or point-to-site tunnels over the internet. ExpressRoute is a private connection that does not travel over the public internet, and Bastion and Application Gateway serve other purposes.

Azure Bastion provides secure RDP and SSH access through the browser without exposing VMs to the public internet. It is not an app host, backup service, or DNS filter.

Traffic Manager uses DNS-based routing to distribute traffic across regional endpoints. Load Balancer and Application Gateway work within a region, and CDN caches content at edge locations.

Azure CDN caches content at global edge nodes to reduce latency and origin load. Traffic Manager routes traffic, VPN Gateway connects networks, and DNS resolves names.

Azure Monitor collects metrics, activity logs, resource logs, and alerts across Azure resources. Policy enforces rules, Backup protects data, and Cost Management tracks spending.

Log Analytics workspaces store log data and support Kusto Query Language (KQL) queries. Metrics Explorer charts numeric metrics, Workbooks create reports, and Alerts trigger notifications.

Alerts monitor conditions on metrics or logs and can trigger notifications or automation. Diagnostic settings route logs, tags organize resources, and locks prevent deletion.

Azure Backup protects VMs, databases, and files with scheduled backups and restores. Site Recovery provides disaster recovery replication, and Monitor observes health.

Site Recovery replicates on-premises or Azure VMs to a secondary region for failover during disasters. Backup protects data with restores, and Traffic Manager routes traffic.

A Recovery Services vault stores Azure Backup data and supports restore operations. Log Analytics stores logs, DNS zones resolve names, and resource groups contain resources.

Resource Graph lets you query Azure resources across subscriptions using KQL. Monitor observes health, Cost Management tracks spend, and Advisor gives recommendations.

Azure Advisor analyzes resources and gives recommendations across cost, security, reliability, and performance. Policy enforces rules, Blueprints package governance, and Service Health reports outages.

Diagnostic settings stream platform logs and metrics to destinations such as Log Analytics, storage, or Event Hubs. They do not delete resources, create subscriptions, or change roles.

Cost Management + Billing provides budgets, cost analysis, and spending alerts. Advisor gives recommendations, Service Health reports incidents, and Resource Graph queries resources.

Owner, Contributor, and Reader are built-in RBAC roles. SuperAdmin is not a built-in Azure RBAC role.

Blob Storage, Azure Files, and Queue Storage are Azure storage services. Azure DNS is a networking service, not a storage service.

An availability set protects against failures within one data center by spreading VMs across fault and update domains. It does not protect against a region-wide outage; availability zones or geo-redundancy address larger failures.

Load Balancer distributes Layer 4 traffic, Application Gateway routes Layer 7 HTTP traffic, Azure Backup protects data, and Azure Monitor collects metrics and alerts.