Why You Can’t Solve Azure Scenario Questions Even Though You Know All The Topics

You’ve memorized RBAC role assignments, VNet configuration, NSG rules, and Key Vault access policies. Yet when the exam throws a multi-step scenario at you—one that touches three or four of these topics at once—you freeze. You recognize every individual component, but you can’t figure out which decision comes first or which service actually solves the problem. This isn’t a knowledge gap. This is an exam-logic gap, and it’s costing Microsoft Azure Administrator (AZ-104) candidates their passing score.

Direct Answer

Microsoft Azure Administrator exam scenarios don’t test isolated topic knowledge—they test your ability to sequence technical decisions in the correct order based on Azure’s dependency hierarchy. The exam vendor measures whether you can identify which layer of access control (Azure AD provisioning → RBAC assignment → NSG filtering → Storage Account firewalls) actually solves each constraint in the scenario. To solve multi-step scenarios consistently, you must replace linear topic study with decision-tree thinking: read the constraint, map it to a specific Azure service responsibility, eliminate services that don’t govern that constraint type, then apply role-based or network-based controls in the correct sequence. Candidates who pass AZ-104 don’t memorize more facts—they recognize which Azure service is the gating factor for each requirement in the scenario.

Why This Happens to Microsoft Azure Administrator Candidates

The exam prep ecosystem teaches you each Azure service in isolation. You study RBAC as a unit: roles, custom roles, scope levels. You study Virtual Networks separately: subnets, peering, DNS. You study Network Security Groups as their own domain: inbound/outbound rules, stateful processing. By the time you reach Storage Accounts, you’ve already learned their access control mechanisms independently.

But the AZ-104 exam doesn’t ask, “What is a custom role?” It asks: A company needs to grant developers permission to deploy App Service instances and manage Key Vault secrets, but prevent them from deleting resource groups. They must also connect to a storage account across a private network without routing traffic through the public internet. Which combination of actions meets these requirements?

Now you’re facing a scenario that touches:

Azure AD group membership
RBAC role scope and assignment
Network architecture (VNet and subnets)
Private endpoints or service endpoints
Storage Account firewall configuration
Possibly App Service networking

The problem: you don’t have a mental model for which decision matters first. Does RBAC solve the network constraint? No—RBAC controls identity access, not network paths. Does an NSG solve the permission problem? No—NSGs block traffic, not identity. You know all four services independently, but you can’t build the decision sequence that actually solves the scenario.

This is the exam-logic gap.

The Root Cause: Applying Textbook Knowledge Instead of Exam-Logic Decision Trees

When you study textbook-style (topic by topic, exam objective by objective), you build knowledge in horizontal layers. You become an expert on RBAC, then an expert on networking, then an expert on storage—but these layers never actually talk to each other in your working memory.

Exam scenarios demand vertical decision chains—where each decision depends on the previous one and constrains the next. Here’s the pattern:

Textbook thinking:

I need to know about RBAC. (memorize role definitions)
I need to know about NSGs. (memorize rule syntax)
I need to know about Key Vault. (memorize access policies)
On the exam: All three are mentioned. Which one is the answer? (panic)

Exam-logic thinking:

The constraint is: “developers need permission to manage Key Vault secrets.” Does RBAC solve this? Yes. Which role? Key Vault Secrets Officer.
The next constraint: “traffic must not traverse the public internet to the storage account.” Does RBAC solve this? No. Does an NSG solve this? No. Does a private endpoint or service endpoint solve this? Yes.
Now: can the developers actually reach the private endpoint? This is where NSG rules become relevant—they either allow or block traffic to the private endpoint subnet.

Notice: RBAC was first because it’s the identity gating factor. Networking was second because it’s the path gating factor. They don’t compete; they stack.

The root cause is that most candidates study Azure services as independent silos, not as stacked layers of control. Azure’s actual architecture is:

Layer 1 (Identity): Azure AD provisioning → User assigned to group Layer 2 (Authorization): RBAC role assignment to group at resource scope Layer 3 (Network Access): VNet, subnet, and NSG rules determine whether traffic reaches the resource Layer 4 (Data Access): Storage Account firewall, Key Vault firewall, App Service access restrictions

If you solve scenarios layer-by-layer in this order, you’ll eliminate wrong answers automatically. If you study each service independently, you’ll second-guess yourself at every scenario question.

How the Microsoft Azure Administrator Exam Actually Tests This

Microsoft doesn’t publish their test-design methodology, but AZ-104 scenario patterns reveal a consistent logic:

The exam prioritizes constraint sequencing. Each scenario lists multiple requirements, and only one sequence of Azure services actually satisfies all of them without side effects. Wrong answers typically:

Solve one constraint but create a new problem
Apply controls at the wrong scope level
Use the right service but in the wrong configuration
Miss a mandatory prerequisite step

Example scenario:

Your organization has 500 users in Azure AD. You need to implement the following:

Developers (50 users) can create and manage App Service instances in the production resource group
Developers cannot delete resource groups or reassign RBAC roles
App Service instances must connect to a database on an on-premises server without exposing database traffic to the public internet
The on-premises network team will manage the VPN gateway. Your job ends at the Azure side.

What should you do first?

A) Create a custom RBAC role that includes the Microsoft.Web/sites/* permission and the Microsoft.KeyVault/vaults/* permission, then assign it to the developers group at the resource group scope.

B) Create a custom RBAC role that includes Microsoft.Web/sites/* permission but excludes Microsoft.Authorization/roleAssignments/write and Microsoft.Resources/subscriptions/resourceGroups/delete, then assign it at the resource group scope.

C) Assign the built-in Contributor role to the developers group at the resource group scope, then create an NSG rule that blocks traffic to on-premises.

D) Create a VNet with a GatewaySubnet and deploy a VPN gateway before assigning any roles.

Analysis:

Wrong answer A: It includes Key Vault permission, but the scenario doesn’t require it. This is a distractor that makes candidates overthink the identity layer. Also, no explicit permission exclusion—developers might inherit dangerous permissions.

Wrong answer C: Contributor role is overkill and allows role reassignment and resource group deletion—direct violation of the constraints. This tests whether candidates read constraints carefully. Also, NSGs don’t block application-level traffic to on-premises; that’s handled at the network layer (VPN/ExpressRoute).

Wrong answer D: Assumes you must build networking first. But the exam brief says, “The on-premises network team will manage the VPN gateway.” Your scope is Azure-side identity and access, not VPN infrastructure.

Correct answer: B. It explicitly excludes dangerous permissions (role assignment write, resource group delete) while granting only what’s needed (Web/sites/*). It assigns at resource group scope, so it doesn’t accidentally grant permissions elsewhere. The on-premises connectivity is already handled by the VPN team—this scenario focuses on the Azure identity and authorization layer.

The exam isn’t testing whether you know what Contributor means. It’s testing whether you can read constraint requirements, map them to specific Azure control layers, exclude irrelevant services, and apply the minimum principle (least privilege).

How to Fix This Before Your Next Attempt

1. Map every exam topic to its control layer

Stop studying RBAC, VNet, and NSG as separate topics. Instead, create a visual map:

Identity Layer (Azure AD):

Azure AD user/group creation
Dynamic group membership
Conditional Access policies

Authorization Layer (RBAC):

Roles (built-in and custom)
Role assignment (who, what role, at what scope)
Role scope: Management

Microsoft Azure Administrator - Scenario Based Exam Logic Explained