AZ-104 interview questions & answers

RBAC controls who can do what to a resource — it grants permissions to users, groups or managed identities at a scope. Azure Policy controls what the resource itself is allowed to be — it audits or enforces rules such as allowed regions, required tags, or permitted SKUs, regardless of who creates it. You use both: RBAC for access, Policy for governance.

Enable a managed identity on the resource (system- or user-assigned), then grant that identity access to the vault with RBAC or an access policy. The platform issues and rotates the credential, so no secret or connection string lives in code or configuration.

GZRS or GRS — geo-redundant storage keeps copies in a paired secondary region. LRS keeps three copies in one datacentre and ZRS spreads them across zones in one region, so neither survives losing the whole region. Use RA-GRS if the app must also read from the secondary during an outage.

It evaluates rules in priority order (lowest number first) matching source/destination, port and protocol; the first match wins and processing stops. NSGs are stateful, so the return traffic is allowed automatically. They can attach to a subnet and/or a NIC — a packet must pass both where both apply.

VNet peering for low-latency, high-bandwidth private connectivity over the Microsoft backbone — simple, and now works across regions (global peering). A VPN gateway if you need encrypted transit or to connect on-prem. Peering is non-transitive, so a hub-and-spoke with a firewall/route tables, or Azure Virtual WAN, is how you let spokes reach each other.

Use a Virtual Machine Scale Set with a shared image, autoscale rules on metrics or schedule, and rolling upgrades so instances update in batches behind a load balancer. For guest patching, enable Azure Update Manager. The image, not the individual VM, is the unit you maintain.

A CanNotDelete lock blocks deletion but allows changes; a ReadOnly lock blocks both. It protects against accidental deletion but it is not access control — anyone with the right RBAC can remove the lock. Pair locks with RBAC and Policy for real protection.

Start in Azure Monitor metrics for CPU, memory, disk IOPS and network; check boot diagnostics and the activity log for recent changes; enable VM insights / Log Analytics to query guest-level data with KQL. Set an alert rule on the metric that was abnormal so it is caught automatically next time.

Enable Azure Backup with a Recovery Services vault and a policy (frequency + retention). Restore is not real until tested, so periodically do an item-level or full restore to a new resource group and verify the data. For whole-region failover of running workloads, use Azure Site Recovery instead.

Right-size from actual metrics, apply Reservations or a Savings Plan for the steady baseline, use Azure Hybrid Benefit if you own Windows/SQL licences, and auto-shutdown non-production. Tag resources and use Cost Management budgets and anomaly alerts so overspend surfaces early.