Commonly Confused Services on AZ-104

Deciding signal

NSGs contain allow/deny rules based on source/destination IP, port, and protocol. They are stateful but simple — no application inspection, no FQDN-based rules, no threat intelligence. They apply at the subnet or NIC level. Azure Firewall is a fully managed stateful firewall with FQDN-based rules (allow or deny by domain name), threat intelligence feed integration, and centralized logging across VNets. Application Gateway WAF is an HTTP/HTTPS reverse proxy with a built-in WAF — it inspects web request content for OWASP top-10 threats and custom rules. The deciding factor is inspection depth: IP/port filter (NSG), FQDN and threat-intelligence rules (Azure Firewall), web-layer content inspection (App Gateway WAF).

Deciding signal

Entra ID (Azure AD) is a cloud identity platform — it handles modern authentication (OAuth, OIDC, SAML), manages users and groups, and is the identity backend for Microsoft 365 and Azure. It does not support legacy Kerberos or LDAP. Entra Domain Services (Azure AD DS) is a managed service that provides traditional LDAP, Kerberos, and NTLM authentication in the cloud — enabling legacy applications that require domain join, Group Policy, or LDAP to run in Azure without on-premises AD. On-premises AD DS runs on Windows Server in your own data center. When a scenario involves lifting and shifting legacy applications that require LDAP or Kerberos to Azure without running domain controllers, Entra Domain Services. When it involves modern cloud identity for Azure and M365, Entra ID.

Deciding signal

VNet Peering connects two Azure VNets directly over the Microsoft backbone — no gateway, no encryption overhead, low latency, high bandwidth. It is the right answer for VNet-to-VNet connectivity within Azure or across regions (global VNet peering). VPN Gateway connects Azure VNets to on-premises networks via encrypted IPsec tunnels over the public internet, or connects two VNets via a VNet-to-VNet connection. ExpressRoute provides a private dedicated circuit from on-premises to Azure via a connectivity provider — bypassing the public internet with guaranteed bandwidth. The signal is the connectivity scope: Azure-to-Azure (VNet Peering), Azure-to-on-premises via internet (VPN Gateway), Azure-to-on-premises via private circuit (ExpressRoute).

Deciding signal

Azure Load Balancer operates at Layer 4 (TCP/UDP) within a region — it distributes traffic based on IP and port without HTTP inspection. Application Gateway operates at Layer 7 within a region — it routes based on URL path, host header, or cookie; terminates SSL; and includes WAF. Traffic Manager is a DNS-based global router — it resolves DNS to different regional endpoints based on routing methods (Performance, Weighted, Geographic, Priority) without proxying traffic. Front Door is a global HTTP/HTTPS proxy with content delivery, WAF, URL routing, and intelligent failover — it proxies and accelerates both static and dynamic content globally.

Deciding signal

An App Registration is the definition of an application in Entra ID — it creates an application object and a service principal. A Service Principal is the identity of an application or service in a specific tenant — it has credentials (client secret or certificate) that the application uses to authenticate. A Managed Identity is an automatically managed service principal for an Azure resource (VM, App Service, Function App) — Azure handles credential rotation, so no secret is stored or managed by the developer. Managed Identity is the right answer when the scenario involves Azure resources accessing other Azure services (Key Vault, Storage) without credential management. Service Principal with a secret is used when the application runs outside Azure or Managed Identity is not supported.

Deciding signal

Azure Snapshots are point-in-time copies of managed disks — they capture the disk state at a specific moment and are stored in Azure Storage. They are taken manually or via scripts and are useful for disk restoration but are not a managed backup service. Azure Backup is a centralized managed backup service with configurable retention policies, lifecycle rules, and cross-region restore capabilities for VMs, databases, file shares, and on-premises workloads. Azure Site Recovery (ASR) provides disaster recovery replication — it continuously replicates VMs to a secondary region so that failover can happen within minutes with a defined RPO and RTO. The distinction: Backup protects against data loss (backup/restore); Site Recovery protects against regional outages (failover/failback).

Deciding signal

LRS (Locally Redundant Storage) replicates data three times within a single datacenter — protects against hardware failures but not datacenter or zone failures. ZRS (Zone-Redundant Storage) replicates across three availability zones in a region — survives a zone failure. GRS (Geo-Redundant Storage) replicates to a secondary region asynchronously — survives a full regional outage but the secondary is read-only by default until failover. GZRS (Geo-Zone-Redundant Storage) combines zone redundancy in the primary region with geo-replication to a secondary region — the highest protection tier. The exam tests which redundancy option matches the failure domain in the scenario: datacenter (LRS), zone (ZRS), region (GRS or GZRS).

Deciding signal

RBAC controls what authenticated users and service principals can do — it grants or denies actions like "create a VM" or "read Key Vault secrets." Azure Policy evaluates resource properties and either audits, denies, or remediates non-compliant configurations — for example, requiring all storage accounts to enforce HTTPS, or requiring specific tags on resources. A user with RBAC permissions to create a storage account can still be blocked by Azure Policy if the storage account configuration does not comply with a policy rule. They operate on different objects: RBAC on identities, Policy on resources.

Deciding signal

Azure Container Registry (ACR) is an image registry — it stores and versions Docker and OCI container images. It does not run containers. AKS is a managed Kubernetes service that runs and orchestrates containerized workloads at scale — it is the right answer when the scenario involves deploying, scaling, and managing containerized microservices. Container Instances (ACI) runs individual containers directly without orchestration — fast to start, billed per second, suitable for simple containerized tasks or jobs that do not need Kubernetes features. When the scenario involves storing container images, ACR. Orchestrating many containers with scaling and networking, AKS. Running a single container quickly without a cluster, ACI.

Deciding signal

The Activity Log captures subscription-level management operations — who created, modified, or deleted a resource, and when. It answers "what happened to this subscription or resource at the control plane?" It is automatically captured and retained for 90 days. Resource Logs (formerly Diagnostic Logs) capture data plane operations within a resource — queries on a database, requests to a storage account, operations on a Key Vault. They are not collected by default and must be enabled. Diagnostic Settings are the configuration that routes Activity Logs and Resource Logs to a destination (Log Analytics workspace, Storage Account, Event Hub). When the scenario asks "what was changed in this subscription last week," Activity Log. When it asks for query logs from a specific database, Resource Logs. When it asks how to send logs to a SIEM, Diagnostic Settings.