AZ-104 Lab Study Guide

Topics Covered

This lab study guide is based on the scenarios shown in your screenshot and focuses on four important Azure admin skills:

1. Restore deleted files from an Azure VM by using Azure Backup
2. Understand Azure File Sync and cloud tiering behavior
3. Know who can create users in a new Microsoft Entra tenant
4. Configure NSG rules correctly for Remote Desktop access

---

Lab 1: Restore Deleted Files from an Azure VM Backup

Scenario

You have an Azure Linux virtual machine protected by Azure Backup. Two files were deleted a week ago. You need to restore only the deleted files, not the whole VM.

Goal

Use File Recovery from a Recovery Services vault to recover individual files.

What You Learn

• Difference between Restore VM and File Recovery
• How Azure Backup mounts a recovery point
• How to copy only the files you need

Correct Sequence

Use these steps in order:

1. From the Azure portal, click File Recovery from the vault
2. Select a restore point
3. Download and run a script
4. Copy the files by using File Explorer

Why This Is Correct

When you only need files or folders, Azure Backup lets you mount a restore point instead of restoring the full virtual machine. The recovery script mounts the backup snapshot so you can browse it and copy the required files.

Lab Steps

Step 1: Open the Recovery Services vault

• Sign in to the Azure portal
• Search for Recovery Services vaults
• Open the vault protecting the VM

Step 2: Locate the protected VM

• Go to Backup items
• Select Azure Virtual Machine
• Open the protected VM

Step 3: Start File Recovery

• Click File Recovery
• Choose the appropriate restore point

Step 4: Download the recovery script

• Azure gives you a script to mount the recovery point
• Run the script on a machine that can access the backup contents

Step 5: Access the mounted recovery point

• Browse the mounted path
• Locate the deleted files

Step 6: Copy the files

• Copy the files to the desired destination using File Explorer or standard OS tools

Validation

• Confirm the deleted files are restored
• Confirm the VM itself was not rolled back
• Confirm no full VM restore job was required

Exam Tip

If the question asks to restore individual files, choose File Recovery, not Restore VM.

Common Mistakes

• Choosing Restore VM when only files are needed
• Trying to use AzCopy for a mounted recovery point when normal file copy is sufficient
• Ignoring the restore point selection step

---

Lab 2: Understand Azure File Sync and Cloud Tiering

Scenario

You have a sync group with:

• Endpoint1 = Cloud endpoint
• Endpoint2 = Server endpoint
• Endpoint3 = Server endpoint

Cloud tiering is enabled for Endpoint3.

You add:

• File1 to Endpoint1
• File2 to Endpoint2

You need to identify where those files will be available within 24 hours.

Goal

Understand how files replicate between cloud and server endpoints.

What You Learn

• The role of the cloud endpoint
• The role of server endpoints
• What cloud tiering changes and what it does not change

Correct Understanding

File1 added to Endpoint1

It will be available on:

• Endpoint1
• Endpoint2
• Endpoint3

File2 added to Endpoint2

It will be available on:

• Endpoint1
• Endpoint2
• Endpoint3

Why This Matters

Any file added to one endpoint in the sync group is synchronized to the other endpoints. Cloud tiering does not stop synchronization. It changes how much data stays cached locally on the server.

Key Concept

Cloud tiering affects local storage usage, not file visibility in the sync group.

A tiered file may appear as a namespace entry and download content when accessed, but it is still part of the synchronized dataset.

Lab Steps

Step 1: Review the sync group design

• One cloud endpoint
• Multiple server endpoints

Step 2: Add a file to the cloud endpoint

• Observe that Azure File Sync replicates metadata and content to server endpoints

Step 3: Add a file to a server endpoint

• Observe that the file syncs to the cloud endpoint
• Then it becomes available to the other server endpoint

Step 4: Review cloud tiering behavior

• On a tiered server, the file may not remain fully cached locally
• The file still exists in the namespace and remains accessible

Validation

Check each endpoint:

• Does the file appear?
• Can the file be opened?
• On a tiered endpoint, does access trigger recall from Azure Files?

Exam Tip

Cloud tiering does not mean files sync only to one server. It only changes caching behavior.

Common Mistakes

• Thinking a file added to the cloud endpoint stays only there
• Thinking cloud tiering disables sync to a server endpoint
• Confusing availability with full local caching

---

Lab 3: Create Users in a New Microsoft Entra Tenant

Scenario

A user named User1 creates a new Microsoft Entra tenant named external.contoso.onmicrosoft.com. You need to determine whether User1 can create new user accounts in that new tenant.

Goal

Understand default administrative authority in a newly created tenant.

Correct Answer

Yes, User1 can create the user accounts.

Why This Is Correct

The user who creates a new Microsoft Entra tenant becomes a Global Administrator in that tenant by default.

What You Learn

• Tenant creation privileges
• Default role assignment in a new tenant
• Difference between Azure subscription roles and Entra directory roles

Important Concept

Azure RBAC roles like Owner on a subscription are different from Microsoft Entra roles like Global Administrator.

Lab Steps

Step 1: Identify the tenant creator

• Determine who created the new tenant

Step 2: Understand the default directory role

• The creator receives administrative authority in the new tenant

Step 3: Determine the required task

• Creating user accounts is a directory-level task
• This requires appropriate Entra permissions

Step 4: Match task to role

• A Global Administrator can create users

Validation

Ask:

• Is this a directory task or a subscription task?
• Who created the tenant?
• What default role did that user receive?

Exam Tip

Do not confuse:

• Subscription Owner
  with
• Global Administrator in Microsoft Entra ID

They are not the same thing.

Common Mistakes

• Assuming an Azure subscription Owner can always manage Entra users
• Forgetting that a new tenant has its own directory roles
• Overlooking who created the tenant

---

Lab 4: Configure NSG Rules for RDP Access Correctly

Scenario

You have:

• A virtual network with a subnet named Subnet1
• Two NSGs:
  • NSG-VM1
  • NSG-Subnet1
• A VM named VM1
• VM1’s NIC is associated with NSG-VM1
• Subnet1 is associated with NSG-Subnet1

You need to enable Remote Desktop connectivity from the internet to VM1.

A proposed solution says:

• Add an inbound rule to NSG-Subnet1
• Allow UDP 3389

Goal

Determine whether this meets the requirement.

Correct Answer

No

Why This Is Correct

RDP requires TCP 3389. Allowing only UDP 3389 is not enough to establish standard Remote Desktop connectivity.

What You Learn

• NSG rule evaluation basics
• Difference between TCP and UDP for RDP
• NIC-level NSG and subnet-level NSG behavior

Important Concept

Traffic must be allowed through the effective NSG path. Even if you add a rule at the subnet, the protocol and port must be correct.

Lab Steps

Step 1: Identify where NSGs are applied

• One at the subnet
• One at the NIC

Step 2: Identify the required protocol

• RDP uses TCP 3389

Step 3: Evaluate the proposed rule

• Rule allows UDP 3389
• This does not satisfy the requirement for standard RDP access

Step 4: Determine the correct approach

To allow RDP from the internet, allow:

• Inbound
• Source: Internet or restricted trusted IP range
• Protocol: TCP
• Destination port: 3389

Validation

Check:

• Is TCP 3389 allowed?
• Is the source scope appropriate?
• Are there conflicting deny rules?
• Are both subnet and NIC NSGs effectively permitting traffic?

Exam Tip

If the question says Remote Desktop, think TCP 3389 first.

Common Mistakes

• Choosing UDP instead of TCP
• Forgetting both NIC and subnet NSGs can affect traffic
• Allowing traffic too broadly instead of limiting source IPs where possible

---

Quick Review Table

Topic	Key Point	Correct Answer
Azure Backup file restore	Use File Recovery for individual files	File Recovery -> Restore point -> Script -> Copy files
Azure File Sync	Files sync across all endpoints in the group	File1 and File2 available on all endpoints
New Entra tenant	Tenant creator becomes admin in new tenant	Yes
RDP with NSG	RDP requires TCP 3389	No to UDP-only rule

---

Exam Traps to Remember

Trap 1: Restore VM vs File Recovery

• Restore VM is for full VM recovery
• File Recovery is for individual files and folders

Trap 2: Cloud Tiering

• Cloud tiering does not stop sync
• It changes local storage and recall behavior

Trap 3: Azure Role vs Entra Role

• Owner manages Azure resources
• Global Administrator manages directory objects and identity settings

Trap 4: RDP Protocol

• RDP = TCP 3389
• UDP alone is not enough for standard RDP access in these exam scenarios

---

Self-Test Questions

1. If a VM backup exists and you need only two deleted files, should you restore the whole VM?

Answer: No. Use File Recovery.

2. If a file is created in the cloud endpoint of Azure File Sync, where does it go?

Answer: It becomes available across the sync group endpoints.

3. Does cloud tiering stop a file from appearing on a server endpoint?

Answer: No. It affects caching, not synchronization.

4. Can the creator of a new Microsoft Entra tenant create users in that tenant?

Answer: Yes.

5. Is UDP 3389 enough for Remote Desktop access?

Answer: No. RDP requires TCP 3389.

---

Final Summary

This lab set teaches four common AZ-104-style ideas:

• Recovering files from Azure Backup uses File Recovery, not full VM restore.
• Azure File Sync replicates files across endpoints, even when cloud tiering is enabled.
• The creator of a new Entra tenant can manage users in that tenant.
• RDP access through an NSG requires TCP 3389, not just UDP.