WELCOME

Azure deployments: ARM, Bicep, and Git 1. An administrator deploys a Bicep file using Azure CLI. What happens to the Bicep definition before Azure Resource Manager processes the deployment? A. It is converted into a PowerShell script. B. It is converted into Kubernetes YAML. C. It is executed directly by each resource provider. D. It is compiled into an ARM JSON template. 2. You need to deploy the same infrastructure to development and production, using different

Automate Azure Deployments Overview of interaction and configuration options for Azure cloud resources Interpret an Azure Resource Manager template or a Bicep file Modify an existing Azure Resource Manager template Modify an existing Bicep file Deploy resources by using an Azure Resource Manager template or a Bicep file Export a deployment as an Azure Resource Manager template, or convert an ARM template to a Bicep file Working with GitHub Overview of interaction and configur

Monitor Resources in Azure — 10 AZ-104 Review Questions 1. You need to investigate short spikes in a VM’s platform CPU percentage over the past hour. Which tool should you use first? A. Azure Storage Explorer B. Azure Monitor Metrics Explorer C. Azure Policy D. Azure Resource Graph 2. You need to send a storage account’s supported resource logs to a Log Analytics workspace and Event Hubs. What should you configure? A. An action group B. An alert processing rule C. Diagnostic

Monitor and Maintain Azure Resources — 10–15% Monitor resources in Azure Interpret metrics in Azure Monitor Configure log settings in Azure Monitor Query and analyze logs in Azure Monitor Set up alert rules, action groups, and alert processing rules in Azure Monitor Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights Use Azure Network Watcher and Connection Monitor 1. Collect and configure telemetry Telemetry

Create and configure Azure App Service Provision an App Service plan Configure scaling for an App Service plan Create an App Service Configure certificates and Transport Layer Security (TLS) for an App Service Map an existing custom DNS name to an App Service Configure backup for an App Service Configure networking settings for an App Service Configure deployment slots for an App Service 1. Provision an App Service plan Choose the region, Windows/Linux OS, pricing tier, and i

Azure Data Concepts, Tools, and Processes — 15 Review Questions 1. An online store must record orders, update inventory, and process payments through many short transactions. Which workload type best describes this requirement? A. OLAP B. OLTP C. Data cataloging D. Historical aggregation 2. A company needs to calculate sales trends across five years of records from multiple business systems. Which workload type is most appropriate? A. OLTP B. File synchronization C. OLAP D. R

Azure Data Concepts Overview The diagram shows how day-to-day business transactions become data for reporting and analysis, and where three common data roles contribute. OLTP versus OLAP OLTP and OLAP describe workload patterns, rather than two exclusive categories of database products. A database platform can support both, although systems are often optimized for one. Characteristic OLTP — Online Transaction Processing OLAP — Online Analytical Processing Purpose Run business

AZ-104 Azure Virtual Machines: Review 1. You are creating an Azure VM. Which resource connects the VM to a subnet in an Azure virtual network? A. Network interface B. Availability set C. Recovery Services vault D. Disk encryption set 2. A VM requires secure administrative access through the Azure portal without assigning a public IP address to the VM. Which service should you consider? A. Azure Traffic Manager B. Azure Bastion C. Azure NAT Gateway D. Azure DNS 3. Which VM fam

Deploy and Manage Azure Compute Resources — 20–25% Create and configure virtual machines Create a virtual machine Configure Azure Disk Encryption Move a virtual machine to another resource group, subscription, or region Manage virtual machine sizes Manage virtual machine disks Deploy virtual machines to availability zones and availability sets Deploy and configure an Azure Virtual Machine Scale Sets Virtual machine cost controls Azure VM reliability settings Azure VM security

AZ-104: Microsoft Azure Administrator — Exam Skills Checklist Use this as a self-assessment tracker. For each bullet, rate yourself: ✅ confident ⚠️ shaky ❌ haven't touched it 1. Manage Azure Identities and Governance — 20–25% Manage Microsoft Entra users and groups Create users and groups Manage user and group properties Manage licenses in Microsoft Entra ID Manage external users Configure self-service password reset (SSPR) Manage access to Azure resources Manage built-in Azu

Configure and manage virtual networks in Azure — 12 questions 1. You create a VNet with address space 10.0.0.0/16. Which pair of subnet ranges is valid and non-overlapping? A. 10.0.1.0/24 and 10.0.1.128/25 B. 10.0.1.0/24 and 10.0.2.0/24 C. 10.0.1.0/24 and 10.1.2.0/24 D. 10.0.0.0/16 and 10.0.2.0/24 2. How many IPv4 addresses are assignable to resources in a typical Azure /24 subnet after Azure’s reserved addresses are excluded? A. 254 B. 256 C. 250 D. 251 3. A VM requires two

Implement and Manage Virtual Networking — 15–20% of exam Configure and manage virtual networks in Azure Create and configure virtual networks and subnets Create and configure virtual network peering Configure public IP addresses Configure user-defined routes Other Azure Network Topics (Express Route) Azure Virtual WAN File share settings, configure identity-based access for storage Azure network performance Optimizations and Redundancy Troubleshoot network connectivity NSG an

The template has 31 subsections and 165 sub-subsection items across its nine major sections. Major section Subsections Sub-subsection items 1. Executive Summary and Strategic Intent 2 17 2. Governance, Scope, and Accountability 4 19 3. CEM and THIRF Strategic Outcomes 3 14 4. Baseline Logging Strategy and Coverage Posture 4 14 5. Mission/Risk-Based Prioritization 3 17 6. Enterprise Logging and Data Strategy 4 17 7. Security, Privacy, Integrity, and Resilience 4 17 8. Validati

Exam domain: Implement and Manage Storage (15–20%) This module covers Azure Storage fundamentals, configuration, access control, data protection, and administration. The core configuration sections align with Microsoft’s current AZ-104 storage objectives; service selection, cost optimization, cybersecurity, and labs provide supporting practical knowledge. 1. Azure Storage Fundamentals Overview of Azure Storage services and storage accounts Introduction to Blob Storage, Azure

1. Section 1 — Azure Storage Fundamentals Which Azure Storage service is designed to store application messages for asynchronous processing? A. Azure Files B. Azure Queue Storage C. Azure Blob Storage D. Azure Table Storage 2. Section 2 — Choosing the Right Storage Solution An organization needs to store frequently accessed documents and provide full-text search across their contents. Which solution best meets this requirement? A. Azure Files with share snapshots B. Blob Stor

Writing a Detection: Overview The core of a detection is its analytic logic: the conditions used to evaluate organizational telemetry and identify activity that may be malicious, suspicious, or inconsistent with expected behavior. Detection logic may use one or more analytic methods, including: Matching a specific string, command, file path, event ID, or field value Combining multiple strings, fields, events, or log sources Correlating related activity across identities, endp

Detection Engineering Design Philosophies At this point in the course, it is useful to take a quick beyond the detection development process and go beyond detection engineering form and process. It is critical to examine the underlying philosophies that make detections more effective, resilient, and operationally valuable. Some detection design requirements are straightforward. As discussed previously, frameworks such as Palantir’s Alerting and Detection Strategy (ADS) estab

Detection Engineering Program: High-Level Frameworks As detection engineering has matured, practitioners have developed frameworks to make detection programs more structured, consistent, and measurable. One of the earliest influential models was Palantir’s Alerting and Detection Strategy (ADS) Framework, introduced nearly a decade ago and subsequently refined. The Problem: Inconsistent Detection Practices Historically, many organizations developed custom detections without a

What detections do I create? A simple answer to this question is, create detections for things you don't have detections for! the harder part of answering this main question is two fudnnamteal questions that udnerpoin it: what do I have detections for? What do I detcetions do I need? Threat Analysis and Identifying Detection Gaps Support Incident response Cyber Threat Intelligence Threats Exposure Gaps & Cyber Threat Intelligence Threat Hunt Missions Five reasons for creating

!!!Note: this is learning Notes, some AI slop. KQL needs to be tested!!! Detecting Microsoft CoPilot Abuse Patterns Because most of these techniques abuse legitimate Copilot functionality rather than exploiting a classic software vulnerability, detection has to shift from "block the bad traffic" to "baseline normal Copilot behavior and flag deviation. Purview / Copilot audit log analysis Monitor for Copilot interactions that retrieve sensitive-labeled content (per Microsoft P