Free AZ-104 flashcards

What does ARM template idempotency mean when redeploying a resource whose desired state already exists?

ARM templates are idempotent, so deploying the same template repeatedly yields the same resource types in the same state. If a resource with the declared properties already exists, Resource Manager makes no changes rather than duplicating, erroring, or rebuilding it.

Redeploying an ARM template whose storage account already exists with identical properties fails because a resource with that name already exists in the group.

ARM templates are idempotent: redeploying the same desired state succeeds without error rather than failing on the existing resource. When the declared properties already match, Resource Manager makes no changes.

When a deny assignment and a role assignment both apply, which one wins?

Deny assignments are evaluated before role assignments. If a deny assignment applies to the user and action, access is blocked regardless of any role assignment that would grant it, so the deny takes precedence and the request is denied rather than allowed.

When a resource has both a role assignment granting access and a deny assignment for the same user and action, Azure Resource Manager checks the role assignment first, so access is allowed.

Wrong because deny assignments are evaluated before role assignments. If a deny assignment applies, access is blocked regardless of any role assignment, so the request is denied rather than allowed.

What is the primary difference between GRS and GZRS?

GRS and GZRS differ only in how data is replicated within the primary region: GRS uses LRS while GZRS uses ZRS for zone-level resilience. Within the secondary region both options always replicate synchronously using LRS, and both create a geo-replicated secondary copy.

GRS creates a secondary region copy while GZRS does not create any secondary copy at all.

Both GRS and GZRS create a copy in a paired secondary region. They differ only in primary-region replication: GRS uses LRS and GZRS uses ZRS in the primary, with the secondary always LRS for both.

Which peering option connects virtual networks in different Azure regions?

Global virtual network peering connects virtual networks that sit in different Azure regions, letting resources reach each other directly over the Microsoft backbone without gateways. Regular (regional) peering only joins virtual networks within the same region.

Regular (regional) virtual network peering can connect two virtual networks that sit in different Azure regions.

Regional virtual network peering only connects virtual networks within the same Azure region, so it cannot join networks in different regions. Connecting virtual networks across regions requires global virtual network peering.