AZ-104 Assessment Strategy

📊 Overview

This guide provides a comprehensive strategy for assessing your readiness for the AZ-104 exam, including practice resources, self-assessment tools, and exam-day preparation tips.

🎯 Assessment Goals

By following this strategy, you will:

• Identify knowledge gaps across all exam domains
• Build confidence through progressive practice
• Develop effective time management skills
• Achieve consistent 80%+ scores on practice exams
• Be fully prepared for the actual exam

---

📈 Progressive Assessment Approach

Phase 1: Baseline Assessment (Week 1)

Objective: Establish your starting point

1. Take the Microsoft Learn Practice Assessment
2. Don't study beforehand - this measures current knowledge
3. Record your score by domain
4. Identify your weakest areas

Baseline Tracking Table:

Domain	Score	Priority
Identity & Governance	__%
Storage	__%
Compute	__%
Networking	__%
Monitoring	__%
Overall	__%

Phase 2: Domain-Focused Practice (Weeks 2-7)

Objective: Strengthen each domain systematically

For each domain:

1. Study the relevant material
2. Complete hands-on labs
3. Take domain-specific quizzes
4. Review incorrect answers
5. Retake until achieving 80%+

Phase 3: Full Exam Simulation (Week 8)

Objective: Simulate real exam conditions

1. Take full-length practice exams
2. Time yourself (100 minutes)
3. No breaks or reference materials
4. Review all answers afterward
5. Target: 85%+ before scheduling real exam

---

📝 Self-Assessment Quizzes by Domain

Domain 1: Identity & Governance (20-25%)

Quick Check Questions:

1. What's the difference between Azure RBAC and Microsoft Entra roles?
2. How do you create a custom RBAC role?
3. What are the three types of Azure Policy effects for enforcement?
4. What's the difference between CanNotDelete and ReadOnly locks?
5. How does management group hierarchy work?

Scenario Questions:

1. A user needs to manage VMs but not create new ones. Which built-in role should you assign?

   • [ ] Owner
   • [ ] Contributor
   • [ ] Virtual Machine Contributor
   • [ ] Reader

2. You need to ensure all resources have a "CostCenter" tag. What should you use?

   • [ ] Resource lock
   • [ ] Azure Policy
   • [ ] RBAC role
   • [ ] Management group

3. Which SSPR authentication method is NOT supported?

   • [ ] Mobile phone
   • [ ] Email
   • [ ] Security questions
   • [ ] Hardware token (without additional setup)

Answers

1. Virtual Machine Contributor - allows managing VMs without full Contributor access
2. Azure Policy - can enforce tagging requirements
3. Hardware token - requires additional Entra ID P1/P2 licensing and configuration

---

Domain 2: Storage (15-20%)

Quick Check Questions:

1. What are the four blob access tiers?
2. What's the difference between LRS, ZRS, and GRS?
3. How do you generate a SAS token?
4. What protocols does Azure Files support?
5. How does lifecycle management work?

Scenario Questions:

1. You need storage that survives a datacenter failure but stays in one region. Which redundancy?

   • [ ] LRS
   • [ ] ZRS
   • [ ] GRS
   • [ ] RA-GRS

2. A blob hasn't been accessed in 60 days. You want to automatically move it to Cool tier. What do you configure?

   • [ ] Access policy
   • [ ] Lifecycle management policy
   • [ ] Stored access policy
   • [ ] Blob versioning

3. You need to give a contractor read access to a specific container for 7 days. What's the best approach?

   • [ ] Share storage account key
   • [ ] Create SAS token with container scope
   • [ ] Assign RBAC Reader role
   • [ ] Create stored access policy

Answers

1. ZRS - Zone-redundant storage replicates across availability zones in one region
2. Lifecycle management policy - automates tier transitions based on rules
3. Create SAS token with container scope - provides time-limited, scoped access

---

Domain 3: Compute (20-25%)

Quick Check Questions:

1. What's the difference between Availability Sets and Availability Zones?
2. How do you configure VM Scale Set autoscaling?
3. What are the main differences between ARM templates and Bicep?
4. What's the difference between ACI and AKS?
5. How do deployment slots work in App Service?

Scenario Questions:

1. You need 99.99% SLA for VMs. What should you use?

   • [ ] Single VM with Premium SSD
   • [ ] Availability Set
   • [ ] Availability Zones
   • [ ] VM Scale Set

2. You want to deploy infrastructure and ensure no resources are deleted that aren't in the template. Which deployment mode?

   • [ ] Incremental
   • [ ] Complete
   • [ ] Validate
   • [ ] What-if

3. You need to test a new version of your web app without affecting production. What should you use?

   • [ ] New App Service plan
   • [ ] Deployment slot
   • [ ] New resource group
   • [ ] Traffic Manager

Answers

1. Availability Zones - provides 99.99% SLA by distributing across zones
2. Complete - removes resources not defined in template (use carefully!)
3. Deployment slot - allows testing and easy swap to production

---

Domain 4: Networking (15-20%)

Quick Check Questions:

1. What's the difference between NSG and Azure Firewall?
2. How does VNet peering work?
3. What are the differences between Azure Load Balancer and Application Gateway?
4. How do you configure private DNS zones?
5. What's the purpose of service endpoints vs private endpoints?

Scenario Questions:

1. You need to allow HTTP traffic from the internet to web servers. Where do you configure this?

   • [ ] Route table
   • [ ] NSG inbound rule
   • [ ] NSG outbound rule
   • [ ] Azure Firewall

2. Two VNets need to communicate. They have overlapping address spaces. What should you do?

   • [ ] Configure VNet peering
   • [ ] Re-address one VNet
   • [ ] Use VPN Gateway
   • [ ] Use ExpressRoute

3. You need Layer 7 load balancing with SSL termination. What should you use?

   • [ ] Azure Load Balancer
   • [ ] Application Gateway
   • [ ] Traffic Manager
   • [ ] Azure Front Door

Answers

1. NSG inbound rule - controls traffic at the subnet or NIC level
2. Re-address one VNet - peering requires non-overlapping address spaces
3. Application Gateway - provides Layer 7 load balancing with SSL termination

---

Domain 5: Monitoring (10-15%)

Quick Check Questions:

1. What's the difference between metrics and logs?
2. How do you create alert rules?
3. What is KQL and where is it used?
4. What's the difference between Azure Backup and Azure Site Recovery?
5. How do action groups work?

Scenario Questions:

1. You need to be notified when VM CPU exceeds 80% for 5 minutes. What do you create?

   • [ ] Activity log alert
   • [ ] Metric alert
   • [ ] Log alert
   • [ ] Service health alert

2. You need to query logs for failed login attempts. Which tool do you use?

   • [ ] Metrics Explorer
   • [ ] Log Analytics with KQL
   • [ ] Activity Log
   • [ ] Azure Advisor

3. You need to protect VMs against regional outages. What should you configure?

   • [ ] Azure Backup
   • [ ] Azure Site Recovery
   • [ ] Availability Set
   • [ ] VM snapshots

Answers

1. Metric alert - monitors numeric metrics with threshold conditions
2. Log Analytics with KQL - queries log data using Kusto Query Language
3. Azure Site Recovery - provides disaster recovery to another region

---

🧪 Practice Exam Resources

Official Microsoft Resources

Resource	Type	Link
Microsoft Learn Practice Assessment	Free	Take Assessment
Exam Sandbox	Free	Launch Sandbox
Study Guide	Free	View Guide

Third-Party Resources

Resource	Type	Notes
Whizlabs	Paid	Multiple practice tests
MeasureUp	Paid	Official Microsoft partner
Udemy Practice Tests	Paid	Various instructors
ExamTopics	Free/Paid	Community-sourced questions

Hands-on Practice

Resource	Type	Notes
Azure Free Account	Free	$200 credit for 30 days
Microsoft Learn Sandbox	Free	Limited time environments
Azure Pass	Free	For training events

---

📋 Exam Readiness Checklist

Knowledge Checklist

Identity & Governance:

• [ ] Can create and manage Entra ID users and groups
• [ ] Understand RBAC roles and assignments
• [ ] Can create and assign Azure policies
• [ ] Know how to configure resource locks
• [ ] Understand management group hierarchy

Storage:

• [ ] Can create storage accounts with appropriate redundancy
• [ ] Understand blob access tiers and lifecycle management
• [ ] Can configure Azure Files and File Sync
• [ ] Know how to generate and use SAS tokens
• [ ] Can configure private endpoints

Compute:

• [ ] Can create VMs with availability options
• [ ] Understand VM Scale Sets and autoscaling
• [ ] Can write and deploy ARM templates and Bicep
• [ ] Know how to deploy containers (ACI, ACR, AKS)
• [ ] Can configure App Service and deployment slots

Networking:

• [ ] Can design VNet topology with subnets
• [ ] Understand NSG rules and priority
• [ ] Can configure DNS zones and records
• [ ] Know how to set up VNet peering and VPN
• [ ] Understand load balancing options

Monitoring:

• [ ] Can configure Azure Monitor and alerts
• [ ] Know how to write basic KQL queries
• [ ] Can configure Azure Backup
• [ ] Understand Azure Site Recovery basics

Practice Score Targets

Assessment Type	Target Score	Your Score
Domain quizzes	80%+ each
Microsoft Learn Practice	80%+
Full practice exams	85%+
Timed practice (100 min)	85%+

---

⏱️ Time Management Strategy

Exam Structure

• Total Time: 100 minutes
• Questions: ~40-60 questions
• Time per Question: ~1.5-2.5 minutes average

Question Type Strategies

Multiple Choice (Single Answer):

• Read all options before answering
• Eliminate obviously wrong answers
• Time: 1-2 minutes

Multiple Choice (Multiple Answers):

• Note how many answers are required
• Verify each selection
• Time: 2-3 minutes

Case Studies:

• Read the scenario carefully first
• Reference back as needed
• Time: 3-5 minutes per question

Drag and Drop:

• Understand the sequence or matching required
• Double-check placements
• Time: 2-3 minutes

Interactive (Labs):

• Follow instructions precisely
• Verify each step
• Time: 5-10 minutes

Time Allocation

Phase	Time	Activities
First Pass	60 min	Answer all questions, flag difficult ones
Second Pass	25 min	Review flagged questions
Final Review	15 min	Check all answers, verify submissions

---

🎓 Exam Day Preparation

One Week Before

• [ ] Confirm exam date and time
• [ ] Review exam policies
• [ ] Ensure valid government ID
• [ ] Test computer and internet (if online)
• [ ] Complete final practice exam

Day Before

• [ ] Light review only (no cramming)
• [ ] Prepare exam environment
• [ ] Get 7-8 hours of sleep
• [ ] Prepare ID and confirmation email
• [ ] Plan arrival time (30 min early)

Exam Day

Before the Exam:

• [ ] Eat a good meal
• [ ] Arrive/log in 30 minutes early
• [ ] Use restroom before starting
• [ ] Clear desk (online proctored)
• [ ] Have water available

During the Exam:

• [ ] Read each question completely
• [ ] Look for keywords (MOST, LEAST, FIRST, NOT)
• [ ] Flag uncertain questions
• [ ] Don't spend too long on any question
• [ ] Use all available time

After the Exam:

• Results displayed immediately (pass/fail)
• Detailed score report within 24 hours
• Certificate in Certification Dashboard
• Badge available for LinkedIn

---

📊 Score Interpretation

Understanding Your Score

• Passing Score: 700/1000
• Scaled Score: Not a percentage
• Domain Scores: Shown as performance level

Performance Levels

Level	Meaning
Needs Improvement	Below passing in this domain
Adequate	Meeting minimum requirements
Strong	Above average performance

If You Don't Pass

1. Don't panic - Many people need multiple attempts
2. Review score report - Identify weak domains
3. Wait 24 hours - Before retaking
4. Focus study - On lowest-scoring domains
5. More hands-on practice - Labs reinforce learning

Retake Policy

Attempt	Wait Time
1st retake	24 hours
2nd retake	14 days
3rd+ retake	14 days
Annual limit	5 attempts per exam

---

🔗 Additional Resources

• Official AZ-104 Exam Page
• Exam Policies and FAQ
• Pearson VUE Test Center Locator
• Request Accommodations
• Certification Dashboard