Every AZ-104 service is a cloud-shaped answer to a problem that on-prem infrastructure solved first with a box, a cable, or a role installed on Windows Server. This tracker walks the timeline, then drills into the pieces that keep showing up on the exam.
Filter by cluster. For every row, ask: is this a role, a protocol, an appliance, or a network design? That distinction is most of what the exam is testing.
| Concept | What it actually is | Runs where |
|---|
The four problems on-prem infrastructure had to solve, in the order companies actually hit them.
The starting point every other diagram reacts against.
Each service above is a separate physical machine, bought, racked, powered, cooled, and patched by the company itself. No sharing of hardware between them — that constraint is what virtualization eventually removes.
VPN · VPN Tunnel · RAS · VPN Concentrator
VPN is not a server or an app — it's a networking technology that wraps traffic in an encrypted tunnel across the public internet. To terminate that tunnel, Windows Server offers RAS (Routing and Remote Access Service), installed as a role exactly like AD DS. At scale, companies swap RAS for a dedicated VPN Concentrator appliance (Cisco, Fortinet, Palo Alto) built to terminate thousands of tunnels at once.
Firewall · DMZ · Reverse Proxy · Pivoting
A DMZ isn't hardware or software — it's a network design: a buffer zone sandwiched between two firewalls. Only public-facing pieces (web server, reverse proxy, public DNS) live there. Domain Controllers, SQL, and file servers never do. A reverse proxy sits in front of internal web apps so clients never talk to them directly — same job as a receptionist screening visitors.
Hypervisor · Hyper-V / VMware ESXi · Virtual Machine · Checkpoint · Elasticity
A hypervisor (Hyper-V on Windows Server, VMware ESXi bare-metal) carves one physical machine into several virtual machines, each behaving like its own computer. A checkpoint is a save-state you can roll back to after a bad update. Elasticity is what falls out of pooling resources: RAM and CPU move to whichever VM needs them instead of being locked to one box — the exact property cloud providers later scaled across entire data centers.
Six problems, solved in order. Each layer exists because the one before it created a new problem.
Company owns a machine per service — no sharing.
AD, DNS, SQL, Exchange give the company one source of truth instead of scattered files.
VPN + RAS let employees reach that source of truth from anywhere, encrypted.
Firewalls + DMZ stop a compromised public-facing box from becoming a compromised company.
Hypervisors let many of those servers share one physical machine and a flexible resource pool.
Azure scales virtualization's resource pool across thousands of physical servers you never have to rack.
Click a card to flip it. Be honest with yourself before marking it known — that's what actually builds recall.
The exam rarely tests the on-prem concept directly — it tests whether you can recognize its cloud descendant.