Microsoft AZ-104: Azure Virtual Machines and Compute — Study Guide

By Laurynas Brazys · 6 August 2026 · #microsoft #az-104 #certification #exam-prep #study-guide

Part of the Microsoft Azure Administrator Associate AZ-104 — Study Guide. Practice with verified answers in the Microsoft exam hub, or take timed practice tests on ExamRoll.io.

Overview

Azure Virtual Machines (VMs) provide elastic compute for Windows and Linux workloads with fine-grained control over size, storage, availability, networking, security, and lifecycle management. Administrators must understand sizing families, availability constructs, scale automation, spot capacity, extensions, storage models, dedicated hosts, backup, and secure access patterns to meet reliability, performance, and cost targets.

Compute Options and Sizing

VM size families target distinct workload profiles. General purpose (Dv, Ev, B-series burstable) balance vCPU-to-memory ratios for web servers, small databases, and application servers. Compute optimized (Fsv2, HB/HBv2 for HPC CPU-bound) maximize vCPU per GB and are tuned for high clock speed, benefitting stateless API tiers, batch workers, and game servers. Memory optimized (Ev5, Mv2/Mv3) offer higher memory per vCPU and support in-memory caches, analytics engines, and large databases. GPU VMs (NV, NVv4 for visualization; NC/ND for CUDA/AI training and inferencing) include NVIDIA GPUs with vGPU partitioning on some SKUs for density and cost efficiency; driver and framework compatibility should be validated and pinned via extensions.

Upgrade and resize operations are constrained by hardware availability in the target cluster; resizing a VM in an availability set can fail with allocation errors if capacity is constrained. Deallocating all VMs in the set and then resizing often succeeds by allowing placement across hardware. When static internal IPs are required, you assign them at the NIC configuration in Azure, not inside the guest OS.

Azure Dedicated Hosts place your VMs on single-tenant physical servers for host-level isolation, compliance, and predictability. Host groups define a collection of hosts in a region and can span availability zones and host fault domains to distribute risk of host failure and maintenance. Host fault domains within a host group ensure VMs are spread across physical racks. Licensing benefits include bringing Windows Server/SQL Server licenses with Software Assurance or Azure Hybrid Benefit and the option to license per host (useful for SQL Enterprise/Windows Datacenter) rather than per-VM, potentially lowering costs for dense consolidation.

Availability, Scale, and Cost Optimization

Availability sets protect against hardware failure and planned maintenance within a datacenter. VMs are distributed across fault domains (distinct power/rack) and update domains (maintenance waves). Typical limits are up to 3 fault domains and 20 update domains; deploy at least two instances to gain the 99.95% SLA. Availability zones provide higher resiliency by placing resources in physically separate datacenter buildings within a region; deploying two or more VMs across zones yields a 99.99% VM SLA. Zones require zone-aware resources, and cross-zone traffic uses a Standard SKU load balancer or application gateway; plan for data egress within a region.

Virtual Machine Scale Sets (VMSS) orchestrate fleets of identical or heterogeneous VMs with integrated autoscaling and health management. Uniform orchestration uses a scale set model with a single VM profile and integrates natively with Azure Load Balancer or Application Gateway. Flexible orchestration supports diverse VM SKUs and instance individuality, combines with availability sets/zones, and suits stateful or mixed roles. Upgrade modes determine rollout behavior: Manual (admin triggers upgrades), Automatic (platform updates all instances when model changes), and Rolling (batches with health probes, pause between batches, and failure thresholds). Autoscale policies react to metrics (CPU, memory via AMA, queue length, custom metrics), schedules, or both; define min/max/desired capacity, cooldowns, and scale-in policies (e.g., newest VM first) to control churn. For inbound management at scale, use load balancer inbound NAT pools on the public or internal Standard Load Balancer. Health probes should target the actual service port and protocol; for SQL Always On with an internal load balancer, use a TCP probe on the listener port rather than HTTP.

Azure Spot VMs exploit unused Azure capacity at deep discounts with no availability guarantees. Eviction occurs when capacity is reclaimed or the market price exceeds your max price; you can set eviction policy to Deallocate (preserve disk for later restart when available) or Delete (tear down on eviction). They integrate with VMSS and Standard Load Balancer for stateless scaling. Suitable use cases include batch processing, CI/CD runners, rendering, fuzzing, and large-scale stateless web farms that can tolerate interruption. Avoid Spot for single-instance production or stateful tiers without checkpointing. Price caps prevent paying more than your threshold; if demand spikes, expect higher eviction rates.

Storage, Backup, and Image Management

Each VM has an OS disk (managed disk, caching optimized for boot) and optional data disks for application storage. The temporary disk (Windows D:, Linux often /dev/sdb) resides on the host and is not persistent; only use it for ephemeral caches or pagefile/swap. Managed disks abstract storage accounts, provide zonal/region redundancy options, simplify scale, and improve availability set distribution. Unmanaged disks placed in customer storage accounts are legacy and should be avoided due to scale and throttling limits. Select disk SKUs according to performance and cost: Premium SSD and Premium SSD v2 for low-latency transactional workloads, Ultra Disk for extreme throughput/IOPS with adjustable performance, Standard SSD for general purpose, and Standard HDD for cold workloads.

Detaching a data disk from a VM before attaching it to another minimizes downtime and preserves data consistency. Resize operations on disks typically require partition/FS expansion in-guest; large changes to VM size can require deallocation.

Azure Backup protects VMs using a Recovery Services vault. Enable backup on the VM or at scale via policy assignment. Backup policies define schedules (daily/weekly), retention (short-term and long-term), and Instant Restore parameters (retain snapshots locally for fast file recovery). Application-consistent backups are available via VSS for Windows or pre/post scripts on Linux. Restores can target an entire VM (typically to a new VM), disks (for reattachment/rapid recovery), or files (file-level restore to any VM in the subscription with secure mounting). Backups work for running and stopped (including deallocated) VMs. Ensure encryption compatibility: Platform-managed keys are supported by default, and Azure Disk Encryption requires additional steps for backup. Consider cross-region restore if your vault has geo-redundant storage enabled and your compliance posture permits.

For golden images, use Azure Compute Gallery to version and replicate images across regions; uploads from on-premises generalized VHDs can be performed with tooling such as Add-AzVhd and then captured into the gallery for consistent provisioning.

Networking, Access, and Observability

Each VM requires at least one network interface (NIC), which contains one or more IP configurations. A single NIC can hold a primary private IP and additional secondary private IPs; associate a public IP to an IP configuration to expose services. Most workloads need only one NIC per VM; sizes determine NIC limits. When deploying five VMs that each need both public and private IPs with identical security posture, create one NIC per VM and a single Network Security Group applied at the subnet (or NIC) to enforce uniform inbound/outbound rules. Private IP assignment should be static at the NIC in Azure to maintain address continuity; do not set static IPs inside the guest. Public IPs should use the Standard SKU for zone and scale set support; pair with a Standard Load Balancer for production.

Accelerated Networking uses SR-IOV to bypass the host datapath and reduce latency, jitter, and CPU overhead. It is supported on select VM sizes and OS images and requires a compatible vNIC at creation time (or a stop/deallocate to enable). Use it for high-throughput, low-latency services and busy gateway tiers.

Azure Bastion provides secure RDP/SSH over TLS directly from the Azure portal or native client without exposing public IPs on VMs. Deploy a Bastion host into the target virtual network in a dedicated subnet named AzureBastionSubnet with a /26 or larger prefix and associate a Standard public IP with the Bastion resource. SKUs include Basic and Standard; Standard adds features such as manual scaling (instances), IP-based connections (to any reachable private IP, including across peered VNets), native client support, session recording integration, and shareable links. Use Bastion to satisfy zero-trust administrative access while avoiding per-VM public endpoints and inbound NAT rules.

VM extensions automate configuration and telemetry. The Custom Script Extension runs PowerShell or Bash during or after provisioning to bootstrap software or inject configuration files; design idempotent scripts and store artifacts in secure storage with SAS tokens. The PowerShell DSC extension applies Desired State Configuration to converge Windows nodes to declared state; use pull servers or Azure Automation State Configuration for at-scale management. The Azure Monitor Agent (installed via extension) streams guest metrics and logs to Log Analytics workspaces under Data Collection Rules; prefer AMA over the legacy Log Analytics/MMA agent for granular data routing, multihoming, and scale.

Availability Constructs in Practice and SLAs

Choose availability sets when you need intra-datacenter redundancy with shared storage backends and do not require zonal placement. Choose availability zones for mission-critical services that demand building-level fault isolation and higher SLA. For scale-out services, combine VMSS with zones for even distribution and automatic healing; pin health probes to workload ports and leverage rolling upgrades to mitigate risk. Understand that single VMs, even with Premium SSD, offer a lower SLA than multi-instance deployments. For cost-sensitive stateless tiers, incorporate a Spot VM pool behind a Standard Load Balancer and set conservative eviction and scale-in policies to protect baseline capacity.

Practical Problem Scenario

Contoso Ltd. operates a multi-tier web application with a stateless API, a stateful Redis cache, and a SQL Server Always On availability group. They must improve resiliency to zonal outages, reduce compute costs for the API tier, secure admin access without public IPs, and standardize monitoring and backups.

Create three subnets in a hub-spoke topology: a shared management subnet (hub), a web/API subnet (spoke), and a data subnet (spoke). Deploy Azure Bastion Standard in the hub’s AzureBastionSubnet (/26) with a Standard public IP. Reason: Bastion enables RDP/SSH over TLS without exposing public IPs on any VM, and the Standard SKU supports IP-based connections across peered VNets, centralizing admin access.
Deploy the API tier as a VM Scale Set (Uniform) across Availability Zones 1, 2, and 3 with a Standard Load Balancer. Enable accelerated networking and set autoscale rules to add instances when average CPU > 65% for 10 minutes and remove when < 35% with a cooldown. Add a secondary Spot VM pool within the same scale set using Flexible orchestration or a companion scale set, configuring max price and Deallocate eviction policy. Reason: VMSS plus zones delivers 99.99% SLA and automatic healing; Spot capacity cuts costs for burst load while Deallocate preserves disks for rapid reuse.
Deploy Redis cache VMs in an availability set with 2+ instances and Premium SSD. Pin fault domains to 2 and rely on the platform’s 20 update domains. Reason: Cache is stateful but can replicate; availability sets provide rack and maintenance isolation without cross-zone latency penalties.
Deploy two SQL Server VMs per zone (Zones 1 and 2) participating in an Always On availability group. Place them on Azure Dedicated Hosts within a host group spanning two zones and two host fault domains. Configure an internal Standard Load Balancer with a TCP probe on the listener port (e.g., 1433) for the AG listener. Reason: Dedicated Hosts provide host-level isolation and licensing efficiency (per-host SQL licensing), while zonal placement and TCP health probing align with SQL listener requirements.
Standardize images via Azure Compute Gallery containing hardened OS images. Use the Custom Script Extension to install application prerequisites and the DSC extension to enforce Windows feature state and registry baselines. Reason: Gallery images ensure consistent provisioning; extensions enable repeatable configuration and drift control.
Configure Azure Monitor Agent via Data Collection Rules to send guest metrics and logs to a Log Analytics workspace. Enable connection monitoring and dependency maps as needed. Reason: AMA is the current agent, supports granular routing, and is required for modern monitoring features and VMSS metric-driven autoscale beyond CPU.
Protect all VMs with Azure Backup in a Recovery Services vault using two policies: Tier-1 policy with daily backups and 30-day retention for API/cache, and Tier-0 policy with daily plus weekly/monthly retention for SQL with application-consistent snapshots. Test restores by performing file-level recovery to a jump VM and full VM restore to a staging network. Reason: Separate policies match data criticality and RPO/RTO; file recovery and VM restore cover ransomware and disaster scenarios.
Assign static private IPs to SQL and Redis NICs at the Azure NIC level; keep API instances dynamic behind the load balancer. Apply a single NSG at each subnet to enforce uniform rules. Enable accelerated networking on busy tiers. Reason: NIC-level static assignment preserves addressing for stateful tiers; subnet-level NSGs minimize rule sprawl; accelerated networking reduces latency and CPU overhead.

This design meets availability, cost, security, and operations goals by combining zones and availability sets appropriately, leveraging Spot for stateless scale, enforcing zero-trust administrative access with Bastion, and standardizing configuration, monitoring, and backup across tiers.

← Azure Subscriptions · All domains · Azure Virtual Networking →

Practice these questions → · Timed practice on ExamRoll.io →