Azure Administrator AZ-104: 5 Question Patterns That Fail Candidates

Most AZ-104 failures are not knowledge failures. They are pattern-reading failures: the candidate recognises every service named in the scenario and still picks the wrong option, because the question is testing a rule about when to use one service rather than what it does.

What the AZ-104 covers

The 5 question patterns that fail candidates

Pattern 1: RBAC versus Policy — the most-asked distinction

Azure RBAC assigns permissions to principals at a scope. Azure Policy assigns permissions to resources at a scope, and it can deny where RBAC cannot. If an option says "deny", it is Policy. If it says "assign the ability to", it is RBAC. This single distinction appears across both Domain 1 questions and many Domain 3 scenarios.

Pattern 2: The storage access tier question

Hot, Cool and Archive tiers differ on two axes at once — access cost versus retrieval cost, and how quickly a blob can be read. The trap is answering on retrieval speed alone. A scenario asking you to store audit logs that are read occasionally but must be retained for seven years usually wants Cool, and often wants you to notice that Archive cannot be read for hours without a rehydration step.

Pattern 3: Network security groups versus Azure Firewall

NSGs filter traffic at the subnet and NIC level with allow and deny rules. Azure Firewall is a managed, centrally managed firewall service with threat intelligence and logging built in, and it runs inside a VNet subnet with its own pricing. Scenarios that mention "centralised network filtering across ten subscriptions" are pointing at Azure Firewall, not at NSGs on every subnet.

Pattern 4: Which identity to use

Domain 1 scenarios test whether you know the difference between a managed identity, a service principal and a user-assigned identity. The pattern: managed identities require no credential storage and are the default for Azure-to-Azure access, service principals are for external or cross-tenant access and need secret rotation, and user-assigned identities exist when you need the identity to survive the resource's lifecycle or to be shared.

Pattern 5: The monitoring-versus-automation scenario

A metric crosses a threshold. The question asks what happens next, and the options are an action group, an alert rule, a scheduled query, or an automation runbook. The trap is choosing an alert when the question describes a repeatable, multi-step remediation — that is Automation, not alerting. Microsoft has moved this distinction deliberately into the blueprint.

How should you actually prepare?

Work through the Microsoft Learn modules paired with a free Azure subscription. AZ-104 is unusually hands-on: almost every concept in the blueprint can be clicked through in the portal in under ten minutes. Candidates who never touch the portal struggle with the service-boundary questions; candidates who deploy a multi-tier application with backup configured rarely miss them.

Once you have built it, run the diagnostic on Certilum for the Microsoft Certified: Azure Administrator Associate, and use the AZ-104 question bank with explanations to close the gaps by domain rather than by topic.