AZ-104
Deep Dive
Compute IaaS in Azure. The AZ-104 tests VM creation and configuration, disk types, networking, extensions, VM states, and secure access strategies.
Contents
An Azure Virtual Machine is an IaaS resource that emulates physical hardware — CPU, memory, network, and storage. You manage the OS, middleware, and applications; Azure manages the underlying physical host.
VMs live in a region and an availability zone (or fault domain). They can join a VNet, and you access them via SSH (Linux) or RDP (Windows).
VM components
Availability SLA
Shared responsibility (IaaS)
The size name encodes the family, subfamily, number of vCPUs, and additional features. Ex: Standard_D4s_v5 = family D, 4 vCPUs, s=Premium SSD, version 5.
| Family | Optimized for | Size examples | Use cases |
|---|---|---|---|
| B (Burstable) | CPU/RAM balance with CPU credits | B2s, B4ms | Dev/test, apps with low average usage but occasional spikes |
| D (General Purpose) | CPU:RAM balance = 1:4 | D4s_v5, D8s_v5 | Web apps, medium-sized databases, enterprise apps. The most versatile. |
| E (Memory Optimized) | High RAM ratio (1 vCPU : 8+ GB RAM) | E4s_v5, E16s_v5 | In-memory SQL Server, SAP HANA, large caches |
| F (Compute Optimized) | High CPU ratio (1 vCPU : 2 GB RAM) | F4s_v2, F8s_v2 | High-performance web servers, game servers, batch processing |
| N (GPU) | GPU (NVIDIA Tesla/A100) | NC6, NV6, ND40rs_v2 | ML/DL training, 3D rendering, scientific simulations |
| L (Storage Optimized) | High local disk throughput (NVMe) | L8s_v3, L32s_v3 | Big data, NoSQL databases, Elasticsearch |
| H (HPC) | High-frequency CPU + InfiniBand | H16r, HB120rs_v3 | CFD simulations, financial modeling, HPC workloads |
Important suffixes in the name
Limits per subscription
• Default: 20 vCores per region per subscription
• There's also a limit per family (e.g.: 20 vCores of family D)
• Request an increase: Portal → Subscriptions → Usage + quotas → Request increase
• Some families (GPU, HPC) have a quota of 0 by default — they require an explicit request
| Disk type | Latency | Max IOPS | Max throughput | Recommended use |
|---|---|---|---|---|
| Ultra Disk | <1 ms | Up to 160,000 | Up to 2,000 MB/s | SAP HANA, tier 1 SQL Server, production Oracle |
| Premium SSD v2 | <1 ms | Up to 80,000 | Up to 1,200 MB/s | Tier 1 DBs, apps that need high latency consistency |
| Premium SSD (v1) | <10 ms | Up to 20,000 | Up to 900 MB/s | General production: SQL, SharePoint, critical apps |
| Standard SSD | <10 ms | Up to 6,000 | Up to 750 MB/s | Web servers, lightweight apps, dev/test environments |
| Standard HDD | 10+ ms | Up to 2,000 | Up to 500 MB/s | Files, backups, rarely accessed data |
Disk types by role in the VM
OS Disk
Contains the OS. Created automatically when the VM is created. Default: Premium SSD on "s" VMs. Typical size 30-128 GB. Can be expanded but not shrunk.
Data Disk
Additional disks for application data. Up to 32 data disks depending on VM size. Can be attached/detached live (hot-swap).
Temp Disk
Ephemeral local disk on the physical host. Very fast. Lost when the VM is stopped/deallocated. Do NOT use for persistent data. Linux: /dev/sdb → /mnt. Windows: D:\.
Managed Disks (recommended)
• Azure manages the disk's Storage Account — you only see the disk
• Native snapshots and backup without configuring Storage Accounts
• Support for Availability Sets/Zones (distribution across fault domains)
• Disk Encryption: Server-side encryption (AES-256, by default), customer-managed keys (CMK), or Azure Disk Encryption (BitLocker/DM-Crypt inside the OS)
Disk Caching — affects performance
None: no cache. Recommended for write-intensive data disks (avoids inconsistencies).
ReadOnly: read cache on the host's SSD. For mostly read-only data disks.
ReadWrite: read and write cache. Default on the OS disk. Don't use on DB data disks.
Network components of a VM
NIC (Network Interface Card)
Connects the VM to a subnet. Has a private IP (static or dynamic). Can have multiple NICs (depending on VM size) to separate traffic.
Public IP (optional)
Public IP assigned to the NIC. Dynamic (changes when the VM is stopped/started) or Static (does not change). Important: dynamic IPs are released on deallocate, static IPs are always billed.
NSG (Network Security Group)
Stateful firewall at NIC or subnet level. Inbound/outbound rules. Priority 100-4096 (lower number = higher priority). Default rules allow VNet and Azure LB, deny internet.
Common ports and access
Network security best practices
Extensions are small agents installed on the VM for configuration, monitoring, or integration with other Azure services. They run inside the VM's context using the VM Agent.
Custom Script Extension
Runs scripts (PowerShell or bash) inside the VM after provisioning. Ideal for initial configuration: installing software, configuring services.
Azure Monitor Agent (AMA)
Collects the VM's metrics and logs and sends them to Azure Monitor / Log Analytics. Replaces MMA (Microsoft Monitoring Agent) and the Diagnostics Extension.
Desired State Configuration (DSC)
Applies and maintains declarative configuration on Windows VMs. Defines the desired state (which software, services, registry keys) and DSC applies it and corrects drift.
Azure AD Login / SSH
Allows logging into the VM using Entra ID credentials instead of local accounts. Removes the need to manage local passwords/keys.
| State | Description | Compute billed? | Disk billed? | Dynamic public IP released? |
|---|---|---|---|---|
| Running | VM powered on and running the OS | Yes | Yes | No |
| Stopped (OS) | VM shut down from inside the OS (shutdown from within) | YES — still on the host | Yes | No |
| Stopped (Deallocated) | VM stopped and released from the physical host (Stop from Azure) | NO | Yes | Yes — released |
| Starting | Transition from deallocated to running | Billing starts | Yes | N/A |
| Deallocating | Process of releasing from the host | Still billed | Yes | N/A |
Classic exam trap
Stopping a VM from inside the OS (shutdown, poweroff) leaves it in the Stopped (NOT deallocated) state — it's still on the physical host and STILL BILLING compute. To stop the compute charge you must do a Stop from the Azure Portal/CLI/PowerShell, which puts it into Deallocated.
Spot VMs (Azure Spot)
Use Azure's unused capacity at reduced prices (up to 90% less). Azure can reclaim the VM with 30 seconds' notice when it needs the capacity.
• Eviction policy: Deallocate (the VM stops, you can restart when capacity is available) or Delete (it's deleted)
• Max price: maximum price you pay per hour. If the spot price exceeds your limit, the VM is evicted.
• No availability SLA
• Ideal for: batch processing, rendering, CI/CD, non-critical environments
• Do NOT use for: production apps, DBs, workloads that require uptime
Reserved Instances (Reserved VM Instances)
1- or 3-year commitments in exchange for discounts of up to 72% over pay-as-you-go. You don't reserve a specific VM — you reserve capacity, and the discount is applied automatically.
• Flexibility: the reservation applies to any VM in the same size group in the region
• Scope: individual subscription, resource group, or Shared (shared across subscriptions)
• Can be cancelled with a penalty or exchanged for another reservation
• Also available for SQL, Storage, Cosmos DB, and more
Azure Hybrid Benefit
If you have Windows Server or SQL Server licenses with Software Assurance, you can apply them to Azure VMs and save up to 49% on licensing cost. Combined with Reserved Instances: up to 80% total discount.
Pay-as-you-go
Base price
Reserved (1 year)
~40% discount
Reserved + Hybrid
~80% discount
What is Azure Bastion
A PaaS service that provides secure SSH/RDP to VMs directly from the Azure Portal through the browser, without needing a public IP on the VM or opening ports 22/3389 in the NSG.
• Deployed in a special subnet called AzureBastionSubnet (minimum /26)
• The VM does NOT need a public IP or an NSG with open ports
• SSH/RDP traffic travels encrypted over HTTPS (443) through the Azure backbone
• Native integration with Entra ID if you have the AAD Login extension
Azure Bastion SKUs
Developer
Free. Shares a service instance. No public IP, no scaling. Only 1 simultaneous connection per VNet. For dev/test.
Basic
Dedicated public IP. Multiple simultaneous connections. No file transfer, no custom ports.
Standard
Everything in Basic + file transfer, custom ports, native client (not just browser), IP-based connection, automatic instance scaling.
Premium
Everything in Standard + session recording, private-only deployment (no public IP on Bastion). For high-security environments.
Run Command
Runs scripts inside the VM through the VM Agent without needing network connectivity (SSH/RDP). Useful for emergencies when the VM does not respond over the network.
Serial Console
Access to the VM's serial port — similar to connecting a physical keyboard to a server. Works even if the OS doesn't boot or networking is broken.
Azure Backup (RSV)
Full managed backup. Configurable retention policies. Recovery points in a vault. Supports restore to a new VM, disk restore, or ILR (file recovery).
When to use
Production. You need long-term retention and documented restore.
Disk Snapshots (Managed)
Incremental point-in-time snapshot of the disk. Stored in Azure Storage. Fast to create. Not managed (no automatic policy).
When to use
Before configuration changes, OS updates, or maintenance scripts.
Azure Site Recovery (ASR)
Continuously replicates VMs to another region. Enables failover to the replica in the event of a region disaster. It's not backup — it's replication for DR.
When to use
Disaster Recovery — RTO of minutes in the event of a full region outage.
Did you get this topic?
Test what you just learned
An administrator shuts down an Azure VM using the 'shutdown' command inside the Windows operating system. What is the billing impact?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.