← Back to Portal
AZ-104 Final Exam Attack Plan
Admin sprint protocol — decision matrices, golden rules, and exam-day strategy.
⚡ AZ-104 ADMIN SPRINT PROTOCOL
Decision Matrices, Comparison Tables, and Golden Rules
Use this document: When you need to make a quick admin decision — "which service?" "which tool?" "which configuration?"
🎯 DECISION MATRICES
Decision 1: Storage Replication SKU
What failure must you survive? ├── Single server/rack failure only (same region) │ └── ZRS (zone-redundant) ├── Regional disaster (entire region down) │ ├── Also need zone protection? → GZRS │ └── Region only? → GRS ├── Need to READ from secondary during outage? │ ├── With zone protection? → RA-GZRS │ └── Region only? → RA-GRS └── Dev/test, no redundancy needed → LRS
| Requirement | Answer |
|---|---|
| ------------- | -------- |
| Zone failure, single region | ZRS |
| Regional disaster | GRS or GZRS |
| Zone + regional | GZRS |
| Read from secondary | RA-GRS or RA-GZRS |
| Lowest cost | LRS |
Decision 2: Storage Access Method
Who/what needs access?
├── Human user via browser/Explorer
│ ├── Blob data → Entra ID role (Storage Blob Data Contributor)
│ └── File share → Entra ID or storage key mount
├── Application in Azure
│ └── Managed Identity (system or user-assigned) → **preferred**
├── External partner temporary access
│ └── SAS with stored access policy (short expiry)
├── Legacy app with connection string
│ └── Account key (rotate regularly; plan migration to MI)
└── Anonymous public website
└── Static website hosting on $web container (only this case)
| Scenario | Answer |
|---|---|
| ---------- | -------- |
| App in Azure accessing blobs | Managed Identity |
| Temporary external access | SAS (user delegation preferred) |
| Admin managing account settings | Storage Account Contributor |
| Developer uploading blobs | Storage Blob Data Contributor |
| Block all public access | Disable public blob access + Policy Deny |
Decision 3: Private Endpoint vs Service Endpoint
Who needs to access the PaaS service?
├── Resources in VNet only, no private IP needed
│ └── Service Endpoint (free, simpler)
├── VNet + on-premises via VPN/ExpressRoute
│ └── Private Endpoint (private IP in VNet)
├── Need to block all public internet access
│ └── Private Endpoint + disable public access
└── DNS resolution to private IP required
└── Private Endpoint + Private DNS Zone
| Factor | Service Endpoint | Private Endpoint |
|---|---|---|
| -------- | :----------------: | :----------------: |
| Private IP | ❌ | ✅ |
| On-prem access | ❌ | ✅ |
| Cost | Free | Per endpoint |
| DNS changes | Minimal | Private DNS zone |
| Blocks public access | Partial | Full (with firewall) |
Decision 4: VM High Availability
How many VMs? What failure to protect?
├── 2+ VMs, protect against rack failure (same DC)
│ └── Availability Set (2+ fault domains, 2+ update domains)
├── Protect against entire datacenter failure
│ └── Availability Zone (deploy VM to zone 1, 2, or 3)
├── Auto-scale identical VMs behind load balancer
│ └── VM Scale Set (combine with AZ for zone-redundant)
├── Low latency between VMs (HPC, SAP app tier)
│ └── Proximity Placement Group
└── Single dev/test VM
└── No HA needed (accept downtime)
| Feature | Rack Failure | DC Failure | Auto-Scale |
|---|---|---|---|
| --------- | :------------: | :----------: | :----------: |
| Availability Set | ✅ | ❌ | ❌ |
| Availability Zone | ✅ | ✅ | ❌ |
| VMSS | ✅ (with config) | ✅ (with AZ) | ✅ |
🔑 Cannot put same VM in both Availability Set AND Availability Zone.
Decision 5: Compute Platform Selection
What is the workload?
├── Web/API, managed PaaS, minimal ops
│ └── App Service
│ ├── Need staging slots? → Standard tier or above
│ └── Containers without K8s? → App Service for Containers
├── Single simple container, run and forget
│ └── Azure Container Instances (ACI)
├── Microservices, scale-to-zero, event-driven
│ └── Azure Container Apps (ACA)
├── Full Kubernetes control, complex orchestration
│ └── AKS
├── Windows/Linux custom OS, legacy apps
│ └── VMs or VMSS
└── Short event-driven code
└── Azure Functions
| Workload | Answer |
|---|---|
| ---------- | -------- |
| Corporate web app | App Service |
| Batch container job | ACI |
| API with HTTP scaling, scale-to-zero | Container Apps |
| Microservices with Dapr | Container Apps |
| Production K8s cluster | AKS |
| SQL Server on Windows with SSRS | VM |
Decision 6: Connect to VM Remotely
How should admin connect to VM?
├── VM has public IP, direct RDP/SSH
│ └── NSG allow 3389/22 from trusted IP only (not 0.0.0.0/0)
├── VM has NO public IP (recommended)
│ ├── Browser-based, no VPN client → Azure Bastion
│ ├── Site-to-site VPN + jump box in VNet → VPN + RDP/SSH
│ └── Point-to-site VPN from admin laptop → P2S VPN + RDP/SSH
└── Automated management, no interactive login
└── Run Command / VM extension / Automation
| Scenario | Answer |
|---|---|
| ---------- | -------- |
| Secure admin access, no public IP | Azure Bastion |
| Developer VPN to VNet | Point-to-Site VPN |
| Corporate network to Azure | Site-to-Site VPN or ExpressRoute |
| Script execution without login | Run Command extension |
Decision 7: Hybrid Identity Method
What are the requirements?
├── Default hybrid, simplest setup
│ └── Password Hash Sync (PHS) via Entra Connect
├── Password must be validated against on-prem DC (no hash in cloud)
│ └── Pass-Through Authentication (PTA)
├── Multiple forests, minimal on-prem server footprint
│ └── Entra Cloud Sync
├── Custom SAML claims, legacy federation
│ └── AD FS federation
└── Cloud-only organisation
└── No sync needed — cloud-only users in Entra ID
| Method | On-Prem Server | Password in Cloud |
|---|---|---|
| -------- | :--------------: | :-----------------: |
| PHS | Connect server | Hash only |
| PTA | Connect + PTA agents | No |
| Cloud Sync | Lightweight agent | Hash only |
| Federation | AD FS + Connect | No |
Decision 8: RBAC Role Selection
What does the user need to do?
├── Full control including access management
│ └── Owner
├── Deploy and manage resources, no access grants
│ └── Contributor
├── View resources only
│ └── Reader
├── Grant/revoke RBAC only
│ └── User Access Administrator
├── Manage VMs but not networking
│ └── Virtual Machine Contributor
├── Upload/download blobs, not manage account
│ └── Storage Blob Data Contributor
├── Manage storage account settings, not blob data
│ └── Storage Account Contributor
└── Built-in role too broad
└── Custom role with specific Actions
Decision 9: Enforce Compliance
What do you need to enforce?
├── Prevent non-compliant resource creation
│ └── Azure Policy with **Deny** effect
├── Log non-compliance but allow creation
│ └── Azure Policy with **Audit** effect
├── Auto-deploy missing configuration (e.g., diagnostics)
│ └── Azure Policy **DeployIfNotExists** (needs managed identity)
├── Prevent accidental deletion
│ └── Resource lock (CanNotDelete)
├── Freeze all changes
│ └── Resource lock (ReadOnly)
└── Control WHO can perform actions
└── Azure RBAC (not Policy)
🔑 Policy = WHAT. RBAC = WHO. Lock = protect specific resources.
Decision 10: Network Troubleshooting Tool
What is the symptom?
├── "Is NSG blocking this traffic?"
│ └── Network Watcher → IP Flow Verify
├── "Where is traffic being routed?"
│ └── Network Watcher → Next Hop
├── "Can VM A reach VM B on port X?"
│ └── Network Watcher → Connection Troubleshoot
├── "What traffic is flowing through NSG?"
│ └── NSG Flow Logs → Traffic Analytics
├── "VPN tunnel won't connect"
│ └── Network Watcher → VPN Troubleshoot
└── "Need to capture packets on NIC"
└── Network Watcher → Packet Capture
Decision 11: Load Balancer Selection
What type of traffic?
├── TCP/UDP, regional, millions of connections
│ ├── Internet-facing → Public Load Balancer
│ └── Internal only → Internal Load Balancer
├── HTTP/HTTPS, SSL termination, URL routing, WAF
│ └── Application Gateway (regional)
├── Global HTTP/S, CDN, WAF at edge
│ └── Azure Front Door
└── DNS-based failover only (no traffic proxy)
└── Traffic Manager
Decision 12: Backup Strategy
What needs protecting?
├── Azure VM (OS + data disks)
│ └── Azure Backup → Recovery Services vault
├── On-premises VM
│ └── Azure Backup with MARS agent or DPM/MABS
├── Azure Files share
│ └── Azure Backup for file shares
├── SQL database in Azure
│ ├── PaaS SQL → Built-in backup (short-term) + LTR
│ └── SQL in VM → Azure Backup SQL workload
├── Accidental blob deletion
│ └── Blob soft delete + versioning
└── Full DR with failover
└── Azure Site Recovery (ASR)
🏆 GOLDEN RULES SUMMARY
| # | Rule |
|---|---|
| --- | ------ |
| 1 | PIM = P2; Conditional Access = P1 |
| 2 | Policy Deny prevents; RBAC permits |
| 3 | ZRS/GRS/GZRS — know the difference |
| 4 | Private Endpoint for on-prem; Service Endpoint for VNet-only |
| 5 | Bastion subnet = AzureBastionSubnet (/26+) |
| 6 | Deallocate VM to stop compute billing |
| 7 | Managed Identity over storage keys |
| 8 | Diagnostic settings must be explicitly enabled |
| 9 | Peering is non-transitive |
| 10 | Container Apps for scale-to-zero microservices |
⚡ SPRINT CHECKLIST (Exam Eve)
- [ ] Can name all 5 domain weights
- [ ] Can explain LRS vs ZRS vs GRS vs GZRS in 30 seconds
- [ ] Know 8+ built-in RBAC roles and their boundaries
- [ ] Know Policy effects: Audit, Deny, DeployIfNotExists
- [ ] Know Bastion subnet name and minimum size
- [ ] Know difference between stop, deallocate, and delete
- [ ] Can list Network Watcher tools and when to use each
- [ ] Know PHS vs PTA vs Cloud Sync
- [ ] Know App Service tier that enables deployment slots (Standard+)
- [ ] Know Container Apps vs ACI vs AKS decision criteria
*Skills measured: April 17, 2026*