Azure Administrator (AZ-104) - Identity, Governance & Virtual Networking Flashcards

Question 1

What is Microsoft Entra ID?

Accepted Answer

Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service that helps employees sign in and access resources. It provides authentication, authorization, and single sign-on (SSO) capabilities for cloud and on-premises applications.

Question 2

How do you manage users and groups in Microsoft Entra ID?

Accepted Answer

Users and groups can be managed via the Azure portal, Azure CLI, Azure PowerShell, or Microsoft Graph API. Users can be internal (cloud-only, synced from on-premises AD) or external (guest users). Groups can be security groups or Microsoft 365 groups.

Question 3

What are Administrative Units in Microsoft Entra ID?

Accepted Answer

Administrative Units (AUs) are Entra ID resources that can contain users and groups. They allow for more granular delegation of administrative permissions, enabling administrators to manage a subset of users or groups within a larger Entra ID tenant.

Question 4

Explain Microsoft Entra ID Conditional Access.

Accepted Answer

Conditional Access is a feature that allows organizations to enforce policies based on specific conditions (e.g., user location, device state, application being accessed, sign-in risk). It helps protect resources by requiring additional authentication or blocking access when conditions are not met.

Question 5

What is the purpose of Azure Role-Based Access Control (RBAC)?

Accepted Answer

Azure RBAC provides fine-grained access management for Azure resources. It allows you to assign specific roles (e.g., `Owner`, `Contributor`, `Reader`, custom roles) to users, groups, service principals, or managed identities at different scopes (management group, subscription, resource group, resource).

Question 6

What is Azure Policy and its primary function?

Accepted Answer

Azure Policy helps enforce organizational standards and assess compliance at scale. It defines rules (policies) that describe the desired state of your Azure resources. Policies can prevent non-compliant resources from being created or modify existing non-compliant resources.

Question 7

Differentiate between Azure RBAC and Azure Policy.

Accepted Answer

RBAC focuses on *who* can do *what* (authorization) on specific resources, controlling management plane actions. Azure Policy focuses on *what* resources *can* or *cannot* be configured as (governance), enforcing rules and standards for resource properties. Analogy: RBAC is like giving someone a key to a specific room; Azure Policy is like setting rules for what furniture can be in that room.

Question 8

When would you use Azure RBAC over Azure Policy?

Accepted Answer

Use Azure RBAC when you need to control specific actions users or applications can perform on Azure resources (e.g., "User A can start/stop VMs in Resource Group X," "Service Principal Y can read secrets from Key Vault Z").

Question 9

When would you use Azure Policy over Azure RBAC?

Accepted Answer

Use Azure Policy when you need to enforce organizational standards, compliance, or cost management across your Azure environment (e.g., "All VMs must use a specific SKU," "All storage accounts must have encryption enabled," "Only resources in specific regions are allowed").

Question 10

What is an Azure Virtual Network (VNet)?

Accepted Answer

An Azure VNet is a logically isolated network in the Azure cloud. It enables Azure resources (like VMs) to securely communicate with each other, the internet, and on-premises networks. VNets provide isolation, segmentation, and routing capabilities.

Question 11

Explain the concept of subnets within an Azure VNet.

Accepted Answer

Subnets allow you to segment a VNet into smaller, isolated network segments. Each subnet is assigned a portion of the VNet's address space. Resources deployed into a subnet receive IP addresses from that subnet's range. Subnets enable network security and routing policies to be applied more granularly.

Question 12

What is VNet Peering and its primary use case?

Accepted Answer

VNet Peering connects two Azure Virtual Networks, allowing resources in both VNets to communicate with each other as if they were in the same network. It's used for connecting VNets in the same or different regions (Global VNet Peering) to enable seamless, low-latency, high-bandwidth connectivity without using VPN gateways.

Question 13

What are Network Security Groups (NSGs) in Azure?

Accepted Answer

NSGs are a fundamental layer of security for Azure resources. They contain security rules that allow or deny inbound and outbound network traffic to/from Azure resources (like VMs, subnets, or network interfaces) based on source/destination IP address, port, and protocol.

Question 14

How do NSG rules determine traffic flow?

Accepted Answer

NSG rules are processed by priority (lowest number evaluated first). Each rule specifies: `Priority` (100-4096), `Direction` (Inbound/Outbound), `Source`/`Destination` (IP address, CIDR block, Service Tag, or Application Security Group), `Source Port Ranges`/`Destination Port Ranges`, `Protocol` (TCP, UDP, ICMP, Any), and `Action` (Allow/Deny). Traffic is evaluated against rules in priority order, and the first matching rule determines the action.

Question 15

What is an Application Security Group (ASG) and how does it enhance NSGs?

Accepted Answer

An ASG allows you to group virtual machines logically by workload (e.g., "Web Servers," "Database Servers") and then use these ASGs in NSG rules. Instead of specifying individual IP addresses, you can reference the ASG, simplifying rule management and making them more dynamic as VMs are added or removed from the group.

Question 16

What is Azure Load Balancer and when would you use it?

Accepted Answer

Azure Load Balancer operates at Layer 4 (transport layer) of the OSI model. It distributes incoming network traffic across multiple healthy virtual machines or instances within a backend pool. It's ideal for simple, high-performance load balancing of TCP/UDP traffic, providing high availability and scalability for applications.

Question 17

What is Azure Application Gateway and when would you use it?

Accepted Answer

Azure Application Gateway operates at Layer 7 (application layer) of the OSI model. It's a web traffic load balancer that enables you to manage traffic to your web applications. It supports features like SSL/TLS termination, cookie-based session affinity, URL-based routing, and a Web Application Firewall (WAF) for enhanced security.

Question 18

Differentiate between Azure Load Balancer and Application Gateway.

Accepted Answer

Azure Load Balancer is Layer 4 (TCP/UDP), offering basic load distribution without SSL offloading or WAF. Azure Application Gateway is Layer 7 (HTTP/HTTPS), providing advanced routing (URL-based, host-based), SSL termination, WAF, and session affinity. Use Load Balancer for non-HTTP/S traffic or simple HTTP/S distribution; use Application Gateway for complex web applications requiring advanced features and security.

Question 19

What are the different Azure Storage Account replication strategies?

Accepted Answer

Azure Storage offers several options for replicating data to ensure durability and high availability: `LRS` (Locally Redundant Storage), `ZRS` (Zone-Redundant Storage), `GRS` (Geo-Redundant Storage), `RA-GRS` (Read-Access Geo-Redundant Storage), `GZRS` (Geo-Zone-Redundant Storage), and `RA-GZRS` (Read-Access Geo-Zone-Redundant Storage).

Question 20

Explain Locally Redundant Storage (LRS).

Accepted Answer

LRS replicates your data three times within a single data center in the primary region. It offers the lowest cost and provides durability against hardware failures within that data center. It does *not* protect against a data center-wide outage.

Question 21

Explain Zone-Redundant Storage (ZRS).

Accepted Answer

ZRS replicates your data synchronously across three Azure availability zones in the primary region. Each availability zone is a separate physical location with independent power, cooling, and networking. ZRS provides durability and high availability even if one availability zone goes down.

Question 22

Explain Geo-Redundant Storage (GRS) and Read-Access Geo-Redundant Storage (RA-GRS).

Accepted Answer

GRS replicates your data three times within the primary region (LRS) and also asynchronously replicates it to a single physical location in a secondary, paired region, providing durability against regional outages. RA-GRS is similar to GRS but also provides read access to the data in the secondary region, allowing your application to read from the secondary region if the primary becomes unavailable.

Question 23

Explain Geo-Zone-Redundant Storage (GZRS) and Read-Access Geo-Zone-Redundant Storage (RA-GZRS).

Accepted Answer

GZRS combines the high availability of ZRS in the primary region with geo-replication to a secondary region. Data is replicated across three availability zones in the primary region and then asynchronously to a single physical location in a secondary, paired region. RA-GZRS is similar to GZRS but also provides read access to the data in the secondary region, enabling higher availability during regional outages by allowing reads from the secondary.

Azure Administrator (AZ-104) - Identity, Governance & Virtual Networking

Card Preview

Related Flashcard Sets

ECON201 - Intermediate Microeconomics & Game Theory

Rust Systems Programming & Ownership Model

NEUR101 - Neurobiology & Action Potentials

French A1/A2 - High-Frequency Vocabulary & Essential Grammar