Many wrong answers on AZ-104 don't come from not knowing a concept; they come from picking a similar feature by mistake. RBAC, Azure Policy, and resource locks all "block something," service endpoints and private endpoints even sound alike, and Recovery Services vaults and Backup vaults both store backups. When two or three options appear as a set, knowing each definition isn't enough; you need to be able to state in one sentence what separates them.
This article is the review installment of the AZ-104 study series. From the features explained in the domain articles, it picks only the groups that often show up as each other's wrong answers on the exam, and restates them with the deciding criteria and the clue phrases that appear in questions.
---
Three Questions That Separate Look-Alike Features
When you meet two similar features, asking these three questions in order separates most of them.
| Question | What it separates | Example | |------|------|------| | What does it control? | People's actions or the state of resources | RBAC is what people can do; Policy is what resources must look like | | How far does it reach? | One resource, subnet, or region vs a subscription or the whole globe | Load Balancer is regional; Front Door is global | | What does it bring back? | A past point in time of data, or the operation of the whole service | Azure Backup restores data; Site Recovery keeps running in another region |
The four governance tools get mixed up especially often. Just remember that each one answers a different question.
!RBAC, Policy, locks, and tags answer different questions
---
Domain 1: Identity and Governance
RBAC vs Azure Policy vs Resource Locks
| Item | Azure RBAC | Azure Policy | Resource lock | |------|------|------|------| | What it controls | Operations a person (security principal) can perform | Resource properties and settings | Deleting or changing the resource itself | | Does it stop an Owner? | Depends on the role | Yes (Deny) | Yes | | Clues in a question | "manage only VMs" | "only approved regions," "if the tag is missing" | "prevent accidental deletion" |
Security Groups vs Microsoft 365 Groups
| Item | Security group | Microsoft 365 group | |------|------|------| | Use | RBAC roles, app assignment, licenses | Shared mailbox, team site, calendar | | Members | Users, devices, other groups | Users only | | Clues in a question | "group devices to apply a policy" | "mail and files the team shares" |
Assigned and dynamic membership is a separate axis from group type. Dynamic groups are managed automatically by attribute rules, so you can't add members directly, and dynamic device groups must be security groups.
---
Domain 2: Storage
LRS vs ZRS vs GRS vs GZRS
| Item | LRS | ZRS | GRS | GZRS | |------|------|------|------|------| | Replication scope | 3 copies in one datacenter | 3 availability zones in one region | LRS in the primary region + LRS in the secondary region | ZRS in the primary region + LRS in the secondary region | | Failures it survives | Disk and rack failures | A datacenter (zone) failure | A regional failure | Both zone and regional failures | | Clues in a question | "cheapest" | "keep writing through a zone failure" | "prepare for a regional disaster" | "highest durability and availability" |
When RA- is added to the name (RA-GRS, RA-GZRS), you can read data from the secondary region at any time. Without it, the secondary region can't be read until a failover.
Soft Delete vs Versioning vs Snapshots
| Item | Soft delete | Blob versioning | Snapshot | |------|------|------|------| | When it's created | Kept for the retention period when deleted | Automatically on every overwrite or modification | Manually, whenever the user wants | | What it protects against | Accidentally deleted blobs and containers | Accidentally overwritten content | Keeping the state at a specific point | | Clues in a question | "recover deleted files within 14 days" | "roll back to a previous version" | "a read-only copy before changing it" |
Access Tiers: Hot vs Cool vs Cold vs Archive
| Item | Hot | Cool | Cold | Archive | |------|------|------|------|------| | Minimum retention | None | 30 days | 90 days | 180 days | | Reading | Immediate | Immediate | Immediate | Offline; rehydration takes hours | | Clues in a question | "accessed frequently" | "accessed occasionally" | "rarely accessed but must read immediately" | "almost never read, hours of waiting are fine" |
Deleting or moving a blob to another tier before the minimum retention period ends adds an early deletion charge for the remaining days.
---
Domain 3: Compute
Availability Sets vs Availability Zones vs Virtual Machine Scale Sets
| Item | Availability set | Availability zones | Virtual Machine Scale Sets | |------|------|------|------| | Failure it protects against | Rack failures and planned maintenance within a datacenter | Failure of an entire datacenter (zone) | Changing load (can be combined with zones or sets) | | VM SLA (2 or more VMs) | 99.95% | 99.99% | Depends on placement | | Clues in a question | "fault domains and update domains" | "even if one datacenter stops" | "adjust the number of VMs automatically with load" |
ACI vs Container Apps vs App Service
| Item | Azure Container Instances | Azure Container Apps | Azure App Service | |------|------|------|------| | Nature | The fastest way to run a single container | Serverless container app platform | Web app hosting platform | | Scaling | No orchestration | Automatic scaling based on KEDA, down to zero | Scale up and out per plan | | Clues in a question | "run a simple batch job briefly" | "scale to zero based on events," "revisions" | "deployment slots," "web app with a custom domain" |
---
Domain 4: Networking
NSG vs ASG vs Azure Firewall
| Item | NSG | ASG | Azure Firewall | |------|------|------|------| | Nature | Layer 4 allow and deny rules attached to subnets and NICs | A grouping of VMs by role, used in NSG rules | A managed central firewall (stateful, FQDN filtering, threat intelligence) | | Used on its own | Yes | No (only as the source or destination of NSG rules) | Yes, usually placed in a hub VNet | | Clues in a question | "block port 3389" | "write rules for the web server group instead of IPs" | "control outbound traffic from many VNets in one place by FQDN" |
Service Endpoints vs Private Endpoints
| Item | Service endpoint | Private endpoint | |------|------|------| | Address | The service keeps using its public endpoint | A private IP is created inside the VNet | | Scope | An optimized route from a subnet to the whole service | One specific resource instance | | On-premises access | Not supported | Private IP reachable over VPN or ExpressRoute | | Clues in a question | "allow only a specific subnet, minimal extra cost" | "disable public access and use a private IP only" |
VNet Peering vs VPN Gateway vs ExpressRoute
| Item | VNet peering | VPN Gateway | ExpressRoute | |------|------|------|------| | What it connects | Azure VNets to each other | A VNet to on-premises (or another VNet) | A VNet to on-premises | | Path | Microsoft backbone | Encrypted tunnel over the internet (IPsec) | A dedicated circuit through a connectivity provider, not over the internet | | Clues in a question | "VMs in two VNets talk over private IPs" | "connect a branch office securely over the internet" | "predictable bandwidth, doesn't go over the internet" |
The comparison of the four load balancing services (Load Balancer, Application Gateway, Front Door, Traffic Manager) is in AZ-104 Public IPs and Choosing a Load Balancing Service.
---
Domain 5: Monitoring and Backup
Metrics vs Logs, Activity Log vs Resource Logs
| Item | Metrics | Activity log | Resource logs | |------|------|------|------| | What it holds | Numeric time series (CPU, request count) | Control plane operations in the subscription (who created or deleted what) | Data plane operations inside a resource | | Collection | Automatic | Automatic, kept 90 days | Collected only after you create a diagnostic setting | | Clues in a question | "alert when CPU exceeds 80%" | "who deleted the VM?" | "who read the Key Vault secret?" |
Alert Rules vs Action Groups vs Alert Processing Rules
| Item | Alert rule | Action group | Alert processing rule | |------|------|------|------| | What it decides | When to fire an alert (scope + condition) | Who to notify and what to do when an alert fires | Adds or suppresses action groups on alerts that already fired | | Clues in a question | "CPU at 80% for 5 minutes" | "email, SMS, run a runbook" | "silence notifications during maintenance" |
Recovery Services Vault vs Backup Vault
| Item | Recovery Services vault | Backup vault | |------|------|------| | Targets | Azure VMs, SQL Server and SAP HANA in VMs, Azure Files, on-premises (MARS) | Azure Disks, Azure Blob, Azure Database for PostgreSQL, and other newer workloads | | Site Recovery | Used | Not used | | Clues in a question | "back up VMs," "back up Azure Files" | "back up managed disk snapshots," "operational backup for blobs" |
Azure Backup vs Azure Site Recovery
| Item | Azure Backup | Azure Site Recovery | |------|------|------| | Purpose | Restore data to a past point in time | Keep the service running in another region during a regional outage | | Key measures | Recovery points, retention | RPO, RTO, failover | | Clues in a question | "bring an accidentally deleted file back to yesterday's state" | "if the primary region stops, run in the secondary region within minutes" |
---
Exam Quick Reference
Key points to check one last time before the exam.