Ishy's AZ104

Two regions within the same geography (e.g. East US & West US). At least 300 miles apart. Only one region in a pair is updated at a time. Used for disaster recovery.

LRS (Locally Redundant, 3 copies one datacenter); ZRS (Zone Redundant, 3 copies across zones); GRS (Geo-Redundant LRS + secondary region); RA-GRS (readable secondary)

Availability Set = protects against rack failure within one datacenter (FDs + UDs). Availability Zone = protects against datacenter failure; physically separate facilities.

Basic = no zone support, no HA ports, no SLA, free. Standard = zones, HA ports, 99.99% SLA, paid.

A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), TXT (text), SRV (service)

Owner (full + role assignment), Contributor (create resources but no roles), Reader (view only)

RBAC = who can do what (permissions). Azure Policy = what is allowed (compliance: tags, locations, SKUs).

Stores backups for Azure VMs, on-prem servers, file shares, SQL in VMs. Supports backup policy & restore (VM, disks, files/folders).

Azure Monitor = collects metrics, logs, alerts, dashboards. Log Analytics = tool inside Monitor to query logs using KQL.

parameters = inputs at deploy;
resources = what deploies;
variables = simplify expressions;
outputs = return values

F1/Free (shared); B1/Basic (dedicated no autoscale); P1v2/Premium (autoscale, staging slots, VNet integration)

SMB = Windows/Linux, AD auth. NFS = Linux only, no AD auth (premium only).

Yes. Subnet NSG applies to all VMs. NIC NSG applies to one VM. Both are enforced (aggregated).

Reservations = pre-pay 1-3 years for VMs/SQL (up to 72% savings). Credits = monthly balance can be free (student/subscriber).

Network Security Groups
Captures IP traffic to/from NSG rules. Stored in storage account/Log Analytics. Used for security monitoring, troubleshooting, compliance.

Lower number = higher priority.
Rules evaluated in order. First match wins.
Default ranges: 100-4096.

Allow = permits traffic matching source/dest/port/protocol.
Deny = blocks it. Deny always overrides lower-priority Allow if matched first.

NSG = Layer 3/4, distributed, Free/Basic
Azure Firewall = Layer 7 (FQDN, TLS inspection), central logging, threat intelligence, paid.

Used with forced tunneling.
Overrides Azure default system routes.
Custom route table - Controls traffic between subnets, VNets, or to on-prem.

Fully managed PaaS. Access via Azure Portal over SSL, secure RDP/SSH to VMs without public IP. Blocks internet exposure.

Basic = no HA ports.
Standard = HA Ports for NVAs (load balance all ports on same backend rule)

Layer 7 load balancer.
Features: WAF (Web Application Firewall), SSL termination, cookie affinity, URL path-based routing, multi-site routing.

VPN Gateway = site-to-site/point-to-site over internet (encrypted).
ExpressRoute = private dedicated connection to Azure (higher throughput, lower latency, no internet).

Private Link = private IP in your VNet to PaaS (fully private).
Service Endpoint = secure access to PaaS (Storage/SQL) over Azure backbone (still public endpoint).

Allows peered VNet to use VPN/ExpressRoute gateway of another VNet.
Single Gateway can be used at a time.
Enabled by 'Use Remote Gateways'.

Default = Azure-provided DNS (168.63.129.16).
Custom DNS = Can be set per VNet. VMs in same VNet can resolve each other by hostname (if default DNS).

Application Performance Monitoring (APM) service.
Detects performance issues, Monitors live web apps.
Includes analytics, metrics, and smart alerts.

Via SDK (instrument code), Agent (codeless for App Services/VMs), or Status Monitor (IIS). Sends telemetry to Log Analytics workspace.

Developer library added to app code. Enables custom events, metrics, traces, exceptions, and distributed tracing. Supports .NET, Java, Node.js, Python, etc.

No code changes required. Enable via Azure Portal for App Services, Azure Functions, VMs, or AKS. Uses auto-instrumentation agents.

Pings your app URL from multiple global locations. Types: URL ping test (basic), Standard test (with request dependencies), Custom track availability test.

Metrics = numerical values (response time, request count), pre-aggregated, low latency. Logs = detailed events (exceptions, traces), higher latency, rich query with KQL.

Replaces Log Analytics Agent (MMA) and Diagnostics Extension. Collects data from VMs, VMSS, on-prem servers. Sends to both Log Analytics workspace and Metrics.

AMA = single agent, supports data collection rules (DCRs), works with Azure Policy, better filtering, Azure Arc support. MMA = legacy, no DCRs, being deprecated.

Defines what data to collect (performance counters, logs, events), where to send (workspace/destination), and how to filter/transform. Applied via Azure Policy.

Windows Event Logs, Syslog (Linux), Performance counters, Text logs, IIS logs, Custom logs (via DCR transformation).

Yes. Same agent can send to multiple Log Analytics workspaces and Azure Monitor Metrics (limited). Configured via DCRs.

Lightweight process enabling Azure VM management. Handles extensions, backup, diagnostics, reset password, custom script execution. Installed by default on marketplace VMs.

Portal: VM -> Properties -> 'Agent status'. CLI: az vm show -g <RG> -n <VM> --query 'osProfile.windowsConfiguration.provisionVMAgent'

Extensions fail to install (no backup, monitoring, custom script). Manual fix: install agent or redeploy VM from marketplace.

VM Agent = required for extensions & management tasks (backup, reset password). AMA = specific extension for data collection (logs, perf metrics). AMA requires VM Agent to run.

Legacy extension for VMs. Collects boot diagnostics, performance counters, event logs, IIS logs. Being replaced by AMA + DCRs.

Agent for IIS-hosted .NET apps. Enables codeless monitoring. Supports automatic instrumentation without code changes. Requires VM Agent.

Built-in integration. Enable via Application Insights key in Function App settings. Tracks requests, exceptions, dependencies, custom events. No SDK required for basic monitoring.

Near real-time telemetry (1-second latency). Useful for deployment validation and issue detection. No sampling applied. Filter by instance, request name, or custom criteria.

AI-powered automatic anomaly detection. Identifies unusual patterns (e.g., failure rate spikes, response time regressions). Generates root cause analysis alerts.

Azure Backup = backs up data (files/VMs) for point-in-time recovery. Azure Site Recovery = replicates entire VMs to another region for disaster recovery/failover.

LRS (Locally Redundant - within datacenter), GRS (Geo-Redundant - paired region), RA-GRS (Read-Access Geo-Redundant - readable secondary region). GRS is default for backups.

Protects backups from accidental deletion. Retains deleted backup data for 14 days (default). Can be disabled but not recommended.

Orchestrates failover of multiple VMs. Defines groups, order, and automation scripts/tasks. Supports manual actions and runbooks.

Managed Kubernetes container orchestration service. Azure manages control plane (master nodes). You manage agent nodes. Supports scaling, monitoring, and integration with ACR.

Manual scaling (az aks scale), Cluster Autoscaler (automatic node scaling based on pod demands), Horizontal Pod Autoscaler (pod scaling based on metrics like CPU).

Private registry for storing container images. Integrates with AKS. Supports geo-replication and security scanning. Used with AKS for image deployment.

Connection Troubleshoot. Tests connectivity between VM and another VM, FQDN, URI, or IP address. Returns latency and hop-by-hop information.

IP Flow Verify. Tests whether a packet is allowed or denied. If denied, identifies which security rule caused the block.

Connection Monitor = continuous monitoring over time (alerts on changes). Connection Troubleshoot = one-time point-in-time test (no ongoing monitoring).

Enforces naming conventions for Microsoft 365/Entra groups. Uses prefix/suffix rules based on user attributes (e.g., department name). Cannot be applied to security groups (Microsoft 365 groups only).

Azure Policy = enforces compliance (tags, locations, SKUs). RBAC = who can do what (permissions). Policy does NOT grant/deny access; it prevents non-compliant deployments.

Container for multiple subscriptions. Enables policy and RBAC inheritance across subscriptions. Supports hierarchical structure (root -> management groups -> subscriptions).

Sets spending threshold for subscriptionesource group. Triggers alerts when cost exceeds threshold (50%, 75%, 100%, etc.). Does NOT stop resources automatically.

Pre-purchase 1 or 3 years of VM/SQL/other services. Up to 72% savings vs. pay-as-you-go. Applies automatically to matching resources in the subscription.

ARM template = JSON-based, verbose, can be generated from portal. Bicep = domain-specific language (DSL), cleaner syntax, transpiles to JSON. Bicep is newer and recommended.

Canary = gradual traffic routing (e.g., 5% to new slot). Blue-Green = swap entire production slot with staging slot (instant cutover).

Azure Files = SMB/NFS file shares (mounted drives). Azure Blob = object storage for unstructured data (REST API, CDN, Data Lake).

Global Layer 7 load balancer. Features: SSL offload, URL-based routing, WAF, custom domain, health probes. Best for global traffic distribution.

Traffic Manager = DNS-based global routing (no traffic proxying). Load Balancer = regional Layer 4 traffic distribution (proxies traffic).

Deny (blocks), Audit (logs), Append (adds fields), Modify (changes), DeployIfNotExists (deploys missing resources).

Hot (frequent access, higher cost), Cool (infrequent, lower cost), Cold (rare access), Archive (offline, lowest cost, hours to rehydrate).

Priority retrieval = 1 hour. Standard retrieval = up to 15 hours.

Syncs on-prem Active Directory to Azure AD. Supports Password Hash Sync, Pass-Through Authentication, or Federation (ADFS).

PHS = hash sync to cloud (users auth against Azure). PTA = agent validates password on-prem (no hash stored in cloud).

Prevents accidental deletion/modification. Types: CanNotDelete (blocks delete), ReadOnly (blocks all changes). Applies to resource group or individual resource.

Yes. ReadOnly lock on NSG prevents any rule modification. CanNotDelete allows modification but prevents deletion.

Changes resource properties during deployment (e.g., add missing tags). Requires managed identity. Different from 'Append' which adds but cannot change existing values.

Orchestrates deployment of ARM templates, policies, RBAC, and resource groups as a single package. Versionable and reproducible.

Stores secrets (passwords, keys, certificates). Integrates with VMs, App Services, and Azure DevOps. Supports soft delete and purge protection.

Azure Firewall = managed PaaS (auto-scaling, high availability). NVA = self-managed VMs (more control, more maintenance).

Basic = always free (automatic). Standard = additional protection (telemetry, alerts, mitigation policies). Requires DDoS Protection Plan.

Scans resources after deployment. If missing (e.g., no diagnostic settings), deploys the required resource. Runs automatically every 24 hours.

Defines notification/automation actions on alerts. Types: Email, SMS, Voice, Webhook, ITSM, Automation Runbook, Logic App.

Personalized dashboard for Azure service issues. Covers: Azure Status (global), Service Health (region-specific), Resource Health (single resource).

Basic = no zones, no availability zones, no cross-region load balancer. Standard = zones, cross-region LB, regional resilience.

Enterprise NFS/SMB file storage. High performance (up to 450k IOPS). Uses NetApp ONTAP. More expensive than standard Azure Files.

Syncs on-prem Windows file servers to Azure Files. Keeps files cached on-prem for fast access. Supports cloud tiering (files moved to cloud when cold).

Block Blob = large files (up to 4.75TB) - best for documents, media, backups. Page Blob = 512-byte pages - used for VHDs (VM disks).

Blob storage + hierarchical namespace. Combines object storage with file system semantics (directories, permissions, ACLs).

Public Zone = resolves internet-facing domains. Private Zone = resolves within VNets only (no public resolution).

Priority (primaryackup), Weighted (percentage split), Performance (lowest latency), Geographic (geo-fencing), Subnet (user IP range), Multivalue (multiple IPs).

Public Standard Load Balancer with cross-region capability. Distributes traffic across multiple regional load balancers. Backend = regional LBs.

Simplifies dynamic routing between NVA and Azure gateway. Uses BGP to exchange routes. Replaces manual UDR configuration.

Hub-and-spoke networking as a service. Includes: hub VNet, VPN Gateway, ExpressRoute Gateway, SD-WAN connectivity. Centralized routing and security.

Optimizes connectivity to Microsoft services (Office 365, Dynamics). Improves route selection and latency. Requires ISP partnership.

Assigns private IP from VNet to PaaS service (Storage, SQL, Key Vault). Traffic never leaves Microsoft backbone. More secure than Service Endpoint.

Extends Azure management to on-prem, multi-cloud, edge. Supports: Servers, Kubernetes, SQL Server, Data Services. Enables Azure Policy on-prem.

Automates cloud management tasks. Features: Runbooks (PowerShell/Python), Desired State Configuration (DSC), Update Management, Change Tracking.

Part of Automation Account. Scans VMs for missing updates. Supports scheduled patching, compliance reporting. Works with Azure and Arc-enabled VMs.

Audits settings inside VMs (e.g., registry keys, services, application config). Requires Azure Policy extension or AMA.

Analyzes cloud spending. Features: Budgets, Alerts, Recommendations (right-sizing, reservations), Exports (to storage), Invoices.

Personalized best practices dashboard. Covers: Cost, Security, Reliability, Performance, Operational Excellence. Provides actionable recommendations.

Centralized tool for migrating on-prem to Azure. Features: Discovery, Assessment (cost/sizing), Replication (agent/agentless), Dependency visualization.

Test Failover (isolated DR test), Planned Failover (zero data loss), Unplanned Failover (actual disaster).

LRS = three copies in one datacenter. ZRS = three copies across zones (resilient to zone failure). ZRS costs more.

Encrypts OS/data disks using BitLocker (Windows) or DM-Crypt (Linux). Integrates with Key Vault. Does NOT work with custom images without prep.

Allows attaching managed disk to multiple VMs simultaneously. Used for clustered applications (SQL FCI, SAP). Requires premium SSD or ultra disk.

Highest performance managed disks (up to 160k IOPS, 2000 MB/s). Configurable IOPS/throughput per disk. Expensive, limited regions.

OS Disk = persistent (D: drive on Windows, /dev/sda1 on Linux). Temp Disk = ephemeral (local SSD, data lost on reboot/stop).

Auto-scaling identical VMs. Supports load balancer integration. Rolling upgrades (batch updates). Spot instance support for cost savings.

Rolling and Automatic upgrades in VMSS? Manual = you choose when. Rolling = batch upgrades with health checks. Automatic = no control, all at once (least recommended).

Physical server dedicated to your VMs. No multi-tenancy. Use for compliance/licensing (Windows Server Datacenter with SA). Most expensive compute option.

Discounted (up to 90%) unused capacity. Can be evicted with 30-second notice. Best for batch jobs, dev/test, NOT production.

Co-locates VMs for lowest latency (single network hop). Used for HPC, SAP, SQL Always On. Affects availability set/VMSS placement.

Staging environments (production, staging, qa). Swap with zero downtime. Warm-up traffic with auto-swap or manual.

Scales out (more instances) based on CPU, memory, or HTTP queue. Custom autoscale rules. Not available on Free/Basic tiers.

Allows App Service to access VNet resources (VMs, Private Endpoints). Regional (same VNet) or Gateway (VPN). Standard/Premium only.

Plan = underlying VM resources (CPU, RAM, scaling). App = actual web app (runs on plan). Multiple apps can share one plan.

Serverless (pay per execution). Automatic scale. Timeout max = 10 minutes. Best for intermittent/sporadic workloads.

Fastest container deployment (no orchestration). Per-second billing. Great for simple workloads (CI/CD, batch jobs). No scaling, no load balancer.

Managed Kubernetes abstraction (but not AKS). Supports microservices, auto-scaling, Dapr. Easier than AKS, more features than ACI.

Watches for unscheduled pods. Adds nodes when pods are pending. Removes nodes when underutilized. Requires configured node pool minimum/maximum.

Scales pod replicas based on CPU/memory metrics. Uses Kubernetes HPA controller. Requires metrics server installed.

Enforces security/compliance on AKS clusters. Uses Gatekeeper (Open Policy Agent). Built-in policies: no privileged containers, no root user, enforce labels.

Controls pod-to-pod traffic (Kubernetes Network Policy). Options: Azure Network Policy (uses OVN), Calico (open-source).

Integrates AKS with Entra ID. Uses Azure RBAC to manage Kubernetes permissions. Different from Kubernetes RBAC (native).

Used for AKS to access Azure resources (ACR, Load Balancer, Storage). Replaces service principals (no secret rotation needed).

Managed Redis cache. Improves app performance (database caching, session store). Tiers: Basic (no SLA), Standard (replication), Premium (persistence, clustering).

Content delivery network. Edge locations worldwide. Reduces latency for static files. Profiles: Verizon (standard/premium), Microsoft (standard), Akamai (standard).

Real-time messaging (WebSockets). Used for live dashboards, chat, notifications. Scales automatically. Integrates with App Service, Functions, AKS.

Event routing service (pub-sub). Connects sources (Blob Storage, Resource Groups) to handlers (Functions, Logic Apps, Webhooks). Push-based (not poll).

Event Grid = event routing (discrete events, low latency). Event Hubs = big data streaming (millions of events, high throughput, longer retention).

Low-code workflow automation. 400+ connectors (Salesforce, SAP, SQL). Pay per execution. Alternative to Microsoft Power Automate.

CI/CD platform. Services: Boards (work tracking), Repos (Git), Pipelines (buildelease), Test Plans, Artifacts. Competes with GitHub Actions.

Azure role (RBAC) = controls access to Azure resources (VMs, storage). Entra role = controls access to directory objects (users, groups, passwords). They operate in different scopes.

Groups where membership is automatically evaluated based on user attributes (e.g., department, location). Requires Entra ID Premium P1 license. Example: (user.department -eq 'Sales')

Deny = blocks deployment (most common). Audit = logs non-compliance but allows deployment. Append/Modify = adds/changes properties. DeployIfNotExists = deploys missing resources.

ReadOnly lock on a VM prevents starting or stopping the VM (changes state!). CanNotDelete lock allows state changes but prevents deletion.

Restricts administrative permissions to a subset of usersroups within an organization. Example: Helpdesk can only reset passwords for Marketing department users.

Append = adds fields to existing resource (e.g., add missing tag). Modify = can change existing values (requires managed identity). Modify is more powerful but needs permissions.

Management Group (highest, inherits down), Subscription, Resource Group. Policy applies to ALL resources within the assigned scope.

Fault Domain = physical rack (shared power/network). Update Domain = reboot grouping during maintenance. Availability Sets distribute VMs across both (max 3 FDs, 20 UDs).

Maximum 3 fault domains. You cannot exceed this. VMs are automatically distributed across up to 3 physical racks.

Up to 20 update domains. Default is 5. This controls how many VMs reboot simultaneously during planned maintenance.

Uniform = identical VMs, same configuration, ideal for stateless workloads. Flexible = mix of VM types/sizes, supports Spot VMs, more complex but flexible.

Scale Up = increase VM size (more RAM/CPU) - requires downtime. Scale Out = increase number of VM instances (horizontal) - no downtime, ideal for web apps.

Minimum = 1 (unless using Spot VMs). Maximum = up to 1000 (100 with standard SKU, 1000 with uniform orchestration). Default scale-out cool-down = 5 minutes.

P2S clients can reach peered VNets IF 'Use Remote Gateway' is enabled on the peering. Gateway Transit allows the peered VNet to use the VPN/ExpressRoute gateway.

Service Tags = Microsoft-managed IP groups (e.g., 'Internet', 'AzureLoadBalancer', 'Storage'). ASGs = user-defined logical grouping of VMs used inside NSG rules.
VNet Peering true/false

True
VNet Peering true/false

False
VNet Peering true/false

True
VNet Peering true/false

True