AZ-104 Flashcards: The Trickiest 50

The 50 questions across all 5 domains where working admins most reliably drop points on the real exam. Selected for plane-confusion (Entra vs RBAC), memorization traps (limits, defaults, minimums), naming ambiguity, and Microsoft-preferred-pattern nuances.

How to Use

Spaced repetition drill: cover the "Back" with your hand, read only the "Front" and the "Trigger phrase," attempt to recall the "Back" out loud before revealing.

Anki import: the format is intentionally simple. Each card is Front: block + Back: block. To import into Anki, use the CrowdAnki add-on and treat this file as source, or copy each pair into an Anki Basic card manually. Trigger phrase + Doc go on the Back.

Recommended cadence: 20 min/day for 3 days = full pass. Then re-drill missed cards day 5 and day 10 (classic Ebbinghaus spacing).

Source ID meaning: [01-Q13] = file 01-identity-governance.md, question 13. [01-S1] = same file, scenario 1. Cross-reference in the source file for full context and options.

Domain 1: Identity + Governance (Cards 1-10)

Card 1 - Plane distinction: Entra role vs Azure RBAC

Front: A user has "User Administrator" (Entra) and tries to create a resource group in a subscription. It fails. Why?

Back: Entra ID roles manage identity objects (users, groups, apps). Azure RBAC roles manage Azure resources. Two SEPARATE role systems. User Admin has zero Azure resource permissions. Fix: grant Contributor or Owner on the RG/sub.

Trigger phrase: the question mentions an Entra role + an Azure resource action, or vice versa. Doc: https://learn.microsoft.com/entra/identity/role-based-access-control/custom-overview [source: 01-Q1]

Card 2 - Who can create Azure custom RBAC role definitions

Front: Which built-in roles can create custom Azure RBAC role definitions in a subscription?

Back: Owner AND User Access Administrator (both have Microsoft.Authorization/roleDefinitions/write). Global Administrator (Entra) does NOT unless they elevate access via the tenant toggle and then get Owner/UAA at some Azure scope.

📊 Visual reference - Azure RBAC scope hierarchy

Trigger phrase: "create custom role" + subscription scope. Doc: https://learn.microsoft.com/azure/role-based-access-control/custom-roles [source: 01-Q4]

Card 3 - Directory Reader vs Azure Reader (naming trap)

Front: What is the difference between "Directory Reader" and "Reader"?

Back: Directory Reader is an ENTRA ID role, reads directory objects (users, groups, apps). Reader is an AZURE RBAC role, reads Azure resources. Same word, different planes. The biggest single-word trap on AZ-104.

Trigger phrase: any role name that sounds like it "reads" something. Doc: https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference [source: 01-Q13]

Card 4 - User Access Administrator scope

Front: Which built-in role lets a user assign RBAC roles to others but grants NO resource read/write?

Back: User Access Administrator. Has only Microsoft.Authorization/ and Microsoft.Support/. Nothing else. Owner adds full resource control; Contributor cannot assign roles.

📊 Visual reference - Azure RBAC scope where you can assign UAA

Trigger phrase: "delegate role assignment" without "manage resources." Doc: https://learn.microsoft.com/azure/role-based-access-control/built-in-roles/privileged [source: 01-Q17]

Card 5 - RBAC evaluation math

Front: How are effective RBAC permissions calculated?

Back: UNION of every role assignment at every applicable scope, MINUS any Deny Assignments. Deny always wins. Scope proximity does NOT matter (a permission at MG scope adds; a narrower Reader does not override a broader Contributor).

📊 Visual reference - RBAC evaluation logic (Microsoft's flowchart)

Trigger phrase: user has multiple role assignments; which permissions apply? Doc: https://learn.microsoft.com/azure/role-based-access-control/overview#how-azure-rbac-determines-if-a-user-has-access [source: 01-Q22]

Card 6 - Which roles can reset ANY user password

Front: Which Entra roles can reset the password of ANY user, including high-privilege admins like Global Administrator?

Back: Only two: Global Administrator and Privileged Authentication Administrator. Password Admin, Helpdesk Admin, and Authentication Admin can only reset non-admin passwords. User Administrator (common trap) can reset most user + limited-admin passwords but CANNOT reset Global Admin, Privileged Role Admin, or Privileged Auth Admin passwords.

Trigger phrase: "reset admin password" or "reset any user password." Doc: https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference#password-administrator [source: 01-Q3]

Card 7 - Policy effects that remediate

Front: Which Azure Policy effect(s) can remediate EXISTING non-compliant resources?

Back: DeployIfNotExists and Modify. Both use a managed identity attached to the assignment to fix resources. Audit only reports. Deny only blocks new/updated non-compliant. Neither Audit nor Deny will fix existing resources.

📊 Visual reference

Trigger phrase: "existing non-compliant resources need remediation." Doc: https://learn.microsoft.com/azure/governance/policy/how-to/remediate-resources [source: 01-Q7]

Card 8 - Exemption vs Exclusion vs Disabled

Front: You want to exempt ONE resource group from ONE policy in an initiative of 30 policies. Which mechanism?

Back: Policy Exemption at the RG scope for that specific policy. Assignment "excludedScopes" removes ALL policies for the scope (too broad). Setting effect to Disabled turns the policy off globally (also too broad).

Trigger phrase: "exempt from one policy" or "carve out one scope." Doc: https://learn.microsoft.com/azure/governance/policy/concepts/exemption-structure [source: 01-Q14]

Card 9 - Data-plane vs control-plane storage role

Front: Service principal needs to READ BLOB CONTENTS in one storage account. Correct role?

Back: Storage Blob Data Reader at the storage account (data plane, Entra auth). "Reader" and "Storage Account Contributor" are CONTROL PLANE only and grant zero access to blob contents. This trap is on the exam most sittings.

Trigger phrase: "read blob contents" or "read files in a container." Doc: https://learn.microsoft.com/azure/storage/blobs/authorize-access-azure-active-directory [source: 01-Q19]

Card 10 - Group-based licensing failure

Front: Group-based licensing: users show "License assignment failed" for the same SKU. First check?

Back: UsageLocation attribute on the user (must be set before ANY license SKU can bind, for regional service compliance). Fix: bulk-set UsageLocation via Graph or CSV, then reprocess.

Trigger phrase: "license assignment failed" or "license not applying." Doc: https://learn.microsoft.com/entra/identity/users/licensing-groups-resolve-problems [source: 01-S8]

Domain 2: Storage (Cards 11-20)

Card 11 - GZRS what does it protect

Front: What does GZRS replicate across?

Back: Three availability zones in the PRIMARY region (synchronously) PLUS the paired SECONDARY region (asynchronously). Add "RA-" for read access to the secondary. Highest durability tier for standard storage.

📊 Visual reference

Trigger phrase: "highest durability" or "zone AND region failure." Doc: https://learn.microsoft.com/azure/storage/common/storage-redundancy [source: 02-Q1]

Card 12 - SMB Azure Files identity: pick ONE

Front: SMB Azure Files supports three identity-based auth methods. What's the constraint?

Back: On-prem AD DS, Entra Domain Services, Entra Kerberos (for Entra-joined clients). Only ONE can be active on a storage account at a time. NFS shares do NOT use identity auth; they use network + export policy.

📊 Visual reference

Trigger phrase: "combine two identity sources on the same storage account." Doc: https://learn.microsoft.com/azure/storage/files/storage-files-active-directory-overview [source: 02-Q4]

Card 13 - Access tier minimum durations

Front: What are the minimum storage durations for Cool, Cold, and Archive tiers?

Back: Cool = 30 days. Cold = 90 days. Archive = 180 days. Deleting or moving before triggers a prorated early-deletion fee. Design lifecycle rules around these.

Trigger phrase: any question about lifecycle rule day thresholds. Doc: https://learn.microsoft.com/azure/storage/blobs/access-tiers-overview [source: 02-Q15]

Card 14 - Premium file shares vs Standard

Front: Which storage account type is REQUIRED for NFSv4.1 file shares?

Back: Premium FileStorage account. Standard GPv2 supports NFSv3 for BLOB (separate feature) but NOT for Files. NFS Files = Premium FileStorage, always.

Trigger phrase: "NFS share" + storage account type. Doc: https://learn.microsoft.com/azure/storage/files/files-nfs-protocol [source: 02-Q5]

Card 15 - Post-failover state

Front: A GRS storage account is customer-failed-over. What redundancy does the account have afterward?

Back: LRS in the former secondary region. NO direct failback. To restore geo-redundancy you must re-enable GRS (triggers full re-copy to a new secondary), then optionally failover back. This is why failover is heavyweight.

Trigger phrase: "after failover" or "failback." Doc: https://learn.microsoft.com/azure/storage/common/storage-initiate-account-failover [source: 02-Q26]

Card 16 - Disable Shared Key blocks what

Front: Storage account has "Allow Shared Key access = Disabled." What is BLOCKED?

Back: Account key auth AND account SAS AND service SAS (all signed with the account key). Entra RBAC and user delegation SAS (Entra-signed) still work. Common hardening lever.

Trigger phrase: "disable shared key" + which auth still works. Doc: https://learn.microsoft.com/azure/storage/common/shared-key-authorization-prevent [source: 02-Q27]

Card 17 - Large file shares constraint

Front: Max size of a Standard file share with Large File Shares enabled? Which redundancy options support it?

Back: 100 TiB. Requires LRS or ZRS storage account. GRS and GZRS do NOT support large file shares as of 2026. Premium file shares also cap at 100 TiB.

Trigger phrase: "increase file share size beyond 5 TiB." Doc: https://learn.microsoft.com/azure/storage/files/storage-files-scale-targets [source: 02-Q28]

Card 18 - Storage account soft limits

Front: Standard GPv2 storage account soft targets for IOPS, request rate, and capacity?

Back: 20,000 IOPS AND 20,000 requests/second per account. 5 PiB (5,120 TiB) capacity soft cap, raised from 500 TiB in a 2023 update. Exceeding causes HTTP 503 SlowDown throttling. Solution: shard across accounts or move to Premium BlockBlob.

Trigger phrase: "503 SlowDown" or "storage throttling under load." Doc: https://learn.microsoft.com/azure/storage/common/scalability-targets-standard-account [source: 02-Q13]

Card 19 - Block blob max size

Front: Maximum size of a single block blob (modern GPv2)?

Back: 190.7 TiB (50,000 blocks x up to 4000 MiB per block). Older docs cite 4.75 TB; that number is out of date. Page blob max is 8 TiB. Do not memorize 4.75 TB.

Trigger phrase: "max block blob size" or the number 4.75 TB appearing as an option. Doc: https://learn.microsoft.com/azure/storage/blobs/scalability-targets [source: 02-Q7]

Card 20 - Object replication prerequisites

Front: What must be enabled on both accounts to use Object Replication?

Back: Blob VERSIONING on both. CHANGE FEED on the source. Both. Accounts can be in different regions/subscriptions. Bidirectional replication needs two one-way policies. Async, typical lag under 15 minutes.

Trigger phrase: "replicate blobs between accounts." Doc: https://learn.microsoft.com/azure/storage/blobs/object-replication-overview [source: 02-Q24]

Domain 3: Compute (Cards 21-30)

Card 21 - VMSS Flexible-only features

Front: Which VMSS features are TRUE only for Flexible (not Uniform) orchestration?

Back: (1) Mixed VM SIZES in one scale set. (2) Manual per-VM management (add/remove named VMs). Both modes support availability zones. Flexible is Microsoft's default recommendation as of 2023+.

Trigger phrase: "mix VM sizes" or "add specific instance to scale set." Doc: https://learn.microsoft.com/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-orchestration-modes [source: 03-Q3]

Card 22 - Availability set max VMs

Front: Max VMs in a single availability set?

Back: 200 VMs. Fault domains 2 or 3 (region dependent). Update domains up to 20. Compare SLAs: single VM w/ Premium disks 99.9%, availability set 99.95%, availability zones 99.99%.

📊 Visual reference (availability zones vs sets context)

Trigger phrase: "max VMs in an availability set" or SLA math questions. Doc: https://learn.microsoft.com/azure/virtual-machines/availability-set-overview [source: 03-Q22]

Card 23 - App Service tier minimum for slots

Front: Minimum App Service tier that supports Deployment Slots?

Back: Standard (up to 5 slots including production). Premium V2/V3 = 20 slots. Isolated = 20. Free/Shared/Basic = NO slots. Common exam question.

📊 Visual reference

Trigger phrase: "deployment slots" + which tier. Doc: https://learn.microsoft.com/azure/app-service/overview-hosting-plans [source: 03-Q11]

Card 24 - ADE = BitLocker + Key Vault

Front: Which VM disk encryption feature uses BitLocker/DM-Crypt inside the guest OS with the key in Key Vault?

Back: Azure Disk Encryption (ADE). SSE encrypts at storage layer transparently. SSE-CMK adds Key Vault to storage-layer encryption. Encryption at Host encrypts caching + temp disk at physical host. Combine all three for end-to-end.

Trigger phrase: "BitLocker" or "DM-Crypt" in the stem. Doc: https://learn.microsoft.com/azure/virtual-machines/disk-encryption-overview [source: 03-Q5]

Card 25 - Spot VM eviction

Front: Spot VM: discount + main constraint?

Back: Up to 90% off. Azure can EVICT with 30 seconds notice when capacity is needed (price-based or capacity-based). Use for interruption-tolerant workloads only (batch, dev/test, media, spot AKS node pools).

Trigger phrase: "cheapest VM tier" or "interruption tolerant." Doc: https://learn.microsoft.com/azure/virtual-machines/spot-vms [source: 03-Q17]

Card 26 - Instant restore snapshot retention

Front: VM backup instant restore snapshot default retention? Configurable range?

Back: Default 2 days. Configurable 1-5 days. Snapshots live in the VM's RG (not the vault) and speed up first-hour restores. After that, restores fall back to vault storage (slower). Snapshots incur additional storage charges.

Trigger phrase: "instant restore" or "snapshot retention" days. Doc: https://learn.microsoft.com/azure/backup/backup-instant-restore-capability [source: 03-Q23]

Card 27 - Ultra Disk performance

Front: Which managed disk type supports sub-millisecond latency and up to 400,000 IOPS per disk?

Back: Ultra Disk. Configurable IOPS and throughput independent of size (up to 10,000 MB/s per disk). Premium SSD v2 (newer, cheaper for many workloads) also decouples size/IOPS/throughput but caps lower. Premium SSD ties performance to disk size (P1-P80).

Trigger phrase: "highest IOPS single disk" or "sub-millisecond latency." Doc: https://learn.microsoft.com/azure/virtual-machines/disks-enable-ultra-ssd [source: 03-Q4]

Card 28 - Run As certificate lifetime

Front: Automation Runbook using a Run As account fails silently at ~1 year uptime. Root cause?

Back: Run As certificate expired (default 1-year lifetime). Microsoft RETIRED Run As account creation in 2023. Modern replacement: system-assigned managed identity on the Automation Account + RBAC on the target subscription.

Trigger phrase: "Runbook fails silently" or "Run As account." Doc: https://learn.microsoft.com/azure/automation/migrate-run-as-accounts-managed-identity [source: 03-S17]

Card 29 - Slot settings behavior on swap

Front: App setting marked "slot setting" during a swap: what happens?

Back: STAYS with the slot (does not swap). This is how you keep prod vs staging config separate. Non-sticky settings move with content. Swap warms up the target and validates before committing.

📊 Visual reference

Trigger phrase: "slot setting" or "sticky config." Doc: https://learn.microsoft.com/azure/app-service/deploy-staging-slots [source: 03-Q6]

Card 30 - Live disk resize availability

Front: Can you expand a VM's OS or data disk WITHOUT deallocation?

Back: Yes, on Premium SSD and Premium SSD v2 since 2023 (live disk expand). Standard SSD still requires deallocation. After disk-level resize, always extend the partition/filesystem inside the guest (diskpart or resize2fs/growfs).

Trigger phrase: "expand disk without downtime." Doc: https://learn.microsoft.com/azure/virtual-machines/disks-expand-live [source: 03-Q26]

Domain 4: Networking (Cards 31-40)

Card 31 - Subnet reservation count

Front: How many IPs does Azure reserve per subnet?

Back: 5 IPs. Network address, Azure default gateway, two for Azure DNS, broadcast equivalent. So a /24 has 251 usable (256 - 5), NOT 254 as on-prem admins expect.

Trigger phrase: any subnet-sizing math question. Doc: https://learn.microsoft.com/azure/virtual-network/virtual-networks-faq [source: 04-Q1]

Card 32 - Gateway transit both sides

Front: VNets A and B are peered. A has a VPN gateway. What must be enabled for B to reach on-prem via A's gateway?

Back: On B's side of the peering: "Use remote gateways." On A's side of the peering: "Allow gateway transit." Both required. Hub-and-spoke pattern. Remember: peering is NOT transitive between spokes.

📊 Visual reference

Trigger phrase: "share gateway across peered VNets." Doc: https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview [source: 04-Q2]

Card 33 - Load Balancer SKU match rule

Front: Standard Load Balancer requires what Public IP SKU?

Back: Standard. SKUs MUST MATCH; Basic PIP with Standard LB fails. Basic SKUs (Public IP and Load Balancer) were RETIRED September 30, 2025; existing Basic resources still run but no new ones can be created. All new deployments must use Standard. Standard PIPs zone-redundant by default in regions with zones.

📊 Visual reference (LB / AGW / FD / TM decision tree)

Trigger phrase: "SKU mismatch" or "Basic being retired." Doc: https://learn.microsoft.com/azure/load-balancer/skus [source: 04-Q8]

Card 34 - NSG priority range

Front: Lowest priority number (highest precedence) you can assign a CUSTOM NSG rule?

Back: 100. Range for custom rules: 100 to 4096 (lower number = higher precedence). Default rules at 65000-65500 cannot be re-prioritized. First match stops evaluation. NSGs are stateful.

Trigger phrase: "override default deny" or NSG priority number. Doc: https://learn.microsoft.com/azure/virtual-network/network-security-groups-overview [source: 04-Q18]

Card 35 - Service endpoint vs private endpoint

Front: Difference between service endpoint and private endpoint for a PaaS service?

Back: Service endpoint tags traffic with VNet+subnet identity that the PaaS firewall enforces; target keeps its PUBLIC IP. Private endpoint deploys a NIC in your VNet with a PRIVATE IP; DNS resolves the PaaS FQDN to that IP. PE is the modern hardening path.

📊 Visual reference

Trigger phrase: "private connectivity to PaaS" or PE vs SE tradeoff. Doc: https://learn.microsoft.com/azure/private-link/private-endpoint-overview [source: 04-Q15]

Card 36 - Static PIP vs IP Prefix

Front: What lets you reserve a specific public IP that you can dissociate and re-associate to a different resource in the same region?

Back: Standard Public IP set to Static (address persists on dissociation). IP Prefix reserves a contiguous /28 to /31 block for allocating PIPs (predictable ranges for allowlisting). Dynamic PIPs (Basic only) release address on dissociation.

Trigger phrase: "reserve IP" or "predictable IP range for whitelisting." Doc: https://learn.microsoft.com/azure/virtual-network/ip-services/public-ip-address-prefix [source: 04-Q28]

Card 37 - Default outbound retirement

Front: Modern recommended patterns for outbound internet from VMs?

Back: NAT Gateway (preferred, per-subnet, 64,512 SNAT ports per attached PIP) OR Standard LB outbound rules OR per-VM public IP OR Azure Firewall SNAT. Default outbound access is RETIRING September 2025; every deployment needs an explicit egress path.

Trigger phrase: "outbound internet" or "SNAT port exhaustion." Doc: https://learn.microsoft.com/azure/virtual-network/ip-services/default-outbound-access [source: 04-Q17]

Card 38 - VPN gateway max throughput

Front: Which VPN Gateway SKU tops the throughput ladder? Aggregate throughput?

Back: VpnGw5, up to 10 Gbps aggregate. Basic is legacy (250 Mbps, no BGP, no active-active, no ExpressRoute coexistence). VpnGw1/2/3/4/5 scale up. Move off Basic for anything production.

Trigger phrase: "highest VPN throughput" or "Basic SKU limitations." Doc: https://learn.microsoft.com/azure/vpn-gateway/vpn-gateway-about-vpngateways [source: 04-Q11]

Card 39 - Azure Firewall rule types

Front: Which are AUTHORABLE Azure Firewall rule types?

Back: THREE: Application rules (FQDN filtering), Network rules (IP/port/protocol), NAT rules (DNAT for inbound). Threat Intelligence is a global TOGGLE (Off / Alert / Alert and Deny), not an authored rule. Route rules don't exist in the firewall; routing changes go on UDRs.

Trigger phrase: "firewall rule type" + trap options like "route rule." Doc: https://learn.microsoft.com/azure/firewall/rule-processing [source: 04-Q6]

Card 40 - Global peering caveat

Front: Global VNet Peering (across regions) supports everything EXCEPT what?

Back: Basic Load Balancer frontends cannot be reached via global peering (Standard LB works fine). Peering is never transitive, intra- or cross-region. Global peering adds no material latency beyond physical propagation delay.

Trigger phrase: "cross-region VNet" + LB behavior. Doc: https://learn.microsoft.com/azure/virtual-network/virtual-network-peering-overview [source: 04-Q20]

Domain 5: Monitoring + Backup (Cards 41-50)

Card 41 - Log Analytics default retention

Front: Default retention for a Log Analytics workspace? Interactive-retention max?

Back: Default 30 days. Max interactive 730 days. Beyond that use Archive tier (up to 12 years) with Search Job / Restore to query, or Storage account export for cheap immutable archive.

Trigger phrase: "workspace retention" or "long-term log storage." Doc: https://learn.microsoft.com/azure/azure-monitor/logs/data-retention-archive [source: 05-Q2]

Card 42 - RSV vs Backup Vault

Front: Recovery Services Vault vs Backup Vault: which workloads live in each?

Back: RSV: VMs, Azure Files, in-VM SQL/SAP HANA, on-prem MABS/DPM, ASR. Backup Vault: Blob, Managed Disks, PostgreSQL Flexible Server, AKS. Both are supported as of 2026; Backup Vault does NOT replace RSV. Trap: Azure Files backup uses RSV (Files predates Backup Vault).

📊 Visual reference

Trigger phrase: "which vault type" for a specific workload. Doc: https://learn.microsoft.com/azure/backup/backup-overview [source: 05-Q6]

Card 43 - KQL bin + summarize pattern

Front: KQL query for hourly count of failed requests: pattern?

Back: requests | where success == false | summarize count() by bin(timestamp, 1h). bin() rounds into buckets; summarize count() by <bucket> returns (bucket, count) rows. Standard time-series pattern in App Insights and Log Analytics.

Trigger phrase: "count by hour" or KQL syntax question. Doc: https://learn.microsoft.com/azure/data-explorer/kusto/query/binfunction [source: 05-Q20]

Card 44 - Update Manager replaces what

Front: What replaced Automation-based Update Management for VM patching?

Back: Azure Update Manager. Native (no Automation Account or Log Analytics required). Works with Azure VMs AND Arc-connected servers. Uses Maintenance Configurations for scheduled deployment windows. Old Update Management retired 2024.

Trigger phrase: "patch scheduling" or "Update Management" (recognize as legacy). Doc: https://learn.microsoft.com/azure/update-manager/overview [source: 05-Q17]

Card 45 - Azure Files backup vault type

Front: Which vault type does Azure Files backup use?

Back: Recovery Services Vault. Not Backup Vault. Even though Blob backup uses Backup Vault, Files predates Backup Vault and stayed on RSV. Enhanced File Share Backup policy supports hourly frequency; snapshots live on source storage as differentials.

📊 Visual reference

Trigger phrase: "backup Azure Files" or vault selection. Doc: https://learn.microsoft.com/azure/backup/azure-file-share-backup-overview [source: 05-Q23]

Card 46 - Advisor's 5 pillars

Front: Azure Advisor recommendations cover which pillars?

Back: Cost, Security, Reliability, Operational Excellence, Performance. Maps to Well-Architected Framework. Cost recommendations most-tested: unattached disks (still billed), orphaned NICs/PIPs, idle VMs, Reservations, right-sizing.

Trigger phrase: "Advisor recommendation categories." Doc: https://learn.microsoft.com/azure/advisor/advisor-overview [source: 05-Q22]

Card 47 - Action group action list (and non-action)

Front: Which action group actions are built-in? What's a common wrong-answer trap?

Back: Built-in: Email, SMS, Push, Voice call, Webhook, Function, Logic App, Automation Runbook, Event Hub, ITSM connector. NO "Restart VM" built-in action (wire it via Runbook or Logic App if needed).

Trigger phrase: "action group can directly restart a VM" (false). Doc: https://learn.microsoft.com/azure/azure-monitor/alerts/action-groups [source: 05-Q19]

Card 48 - Backup soft delete defaults

Front: Recovery Services Vault backup soft delete: default retention? Max?

Back: Default 14 days. Extendable up to 180 days. On by default. Immutable Vault option (2023) locks retention against admin shortening. Restrict "Backup Contributor" role since it can disable soft delete.

Trigger phrase: "backup accidentally deleted" recovery window. Doc: https://learn.microsoft.com/azure/backup/backup-azure-security-feature-cloud [source: 05-Q8]

Card 49 - Log Analytics CLI namespace

Front: CLI command to create a Log Analytics workspace?

Back: az monitor log-analytics workspace create -g RG1 -n W1 -l eastus. NOT az monitor workspace create (that's Managed Prometheus). PowerShell equivalent: New-AzOperationalInsightsWorkspace (resource type is Microsoft.OperationalInsights/workspaces).

Trigger phrase: "create workspace" via CLI or PowerShell. Doc: https://learn.microsoft.com/cli/azure/monitor/log-analytics/workspace [source: 05-Q10]

Card 50 - Metrics storage separate from Logs

Front: Where do Azure resource metrics live by default?

Back: Azure Monitor time-series METRICS store (93-day retention). NOT a Log Analytics workspace unless you route metrics via a Diagnostic Setting (they land in AzureMetrics table). Two separate stores. Metric alerts fire against the metrics store (near real-time); log alerts against the workspace (higher latency).

Trigger phrase: "where are metrics stored" or metric vs log alert timing. Doc: https://learn.microsoft.com/azure/azure-monitor/essentials/data-platform-metrics [source: 05-Q1]

Summary of the 50 Trickiest

Distribution by domain: 10 cards each (Identity, Storage, Compute, Networking, Monitoring).

Distribution by trap type:

• Plane confusion (Entra vs RBAC role name overlap): cards 1, 2, 3, 4, 6, 9
• Memorize the number (limits, defaults, minimums): cards 13, 17, 18, 19, 22, 23, 26, 27, 31, 33, 34, 38, 41, 48
• Modern-preferred pattern displaces legacy: cards 15, 28, 37, 44
• Cross-service naming trap (SKU match, vault type, control vs data plane): cards 9, 33, 42, 45, 49
• Feature availability caveat (which tier, which redundancy, which orchestration): cards 12, 14, 17, 21, 23, 30, 40

If you can consistently recall all 50 cold, you have covered the highest-yield trap surface on AZ-104.