Azure Fundamentals
What does Azure Monitor collect and analyze?
Azure Dedicated Host provides physical servers dedicated to a single customer's workloads, giving control over maintenance windows, VM placement, and compliance, while also enabling use of existing on-premises Windows Server or SQL Server licenses through Azure Hybrid Benefit.
Azure Policy enables you to create, assign, and manage policies that enforce rules and effects over your resources, ensuring compliance with corporate standards.
Azure Monitor collects telemetry data (metrics and logs) from Azure and on-premises environments, providing visibility into performance, availability, and the overall health of applications and infrastructure.
Azure RBAC is built on Azure Resource Manager and provides fine-grained access management for Azure resources using role definitions, assignments, and scopes.
Azure Fundamentals
What is Azure Service Health?
Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP). It provides vulnerability assessments, security recommendations, compliance score against standards, and threat protection for VMs, SQL, Storage, and Kubernetes.
Service Health is a personalized dashboard showing Azure service incidents, planned maintenance, and health advisories affecting your subscriptions. It also includes Resource Health for individual resource status and an Action Groups integration for proactive notifications.
Azure Front Door is a modern cloud CDN that provides global load balancing, SSL offloading, application acceleration, and WAF protection for delivering web applications with high availability and performance.
Azure Advisor analyzes your configurations and usage telemetry and provides personalized recommendations to improve cost, security, reliability, operational excellence, and performance.
Azure Fundamentals
What is the difference between Hot and Cool access tiers for Azure Blob Storage?
Hot tier has higher storage cost but lower access cost, optimized for frequent read/write. Cool tier has lower storage cost but higher access and longer retrieval latency (minutes), for data accessed less than once per month and stored at least 30 days.
The Consumption plan bills only for execution time and is fully serverless with cold starts. The Premium plan provides pre-warmed instances, no cold starts, VNet integration, and predictable performance, billed per second of execution.
Azure Queue Storage is used for storing large numbers of messages that can be accessed asynchronously by applications, enabling reliable message passing between application components.
Reservations are commitments (1 or 3 years) for specific VM SKUs, regions, and other resources, offering up to ~72% discount. Savings Plans are flexible commitments for compute spend across regions/VMs, with up to ~65% discount.
Azure Fundamentals
What is the Azure spending limit, and which account type offers it?
Azure Monitor Logs (Log Analytics workspace). It ingests data from Azure resources, agents, and connectors, and supports KQL queries, alerts, workbooks, and dashboards, often paired with Microsoft Sentinel for security analytics.
Azure Policy enables you to create, assign, and manage policies that enforce rules and effects over your resources, ensuring compliance with corporate standards.
The spending limit prevents Azure charges beyond a monthly credit on free trial and some legacy subscription types. It is not available on Pay-As-You-Go, Enterprise Agreement, or CSP subscriptions, which have no hard cap by default.
Azure Dedicated Host provides physical servers dedicated to a single customer, ensuring no other organizations share the hardware. It supports compliance requirements, predictable performance, and license benefits like Windows Server and SQL BYOL.
Azure Fundamentals
What is the purpose of Azure Container Registry (ACR)?
ACI is best suited for running isolated containers quickly without managing servers, ideal for simple applications, task automation, and burst workloads with per-second billing.
Azure Kubernetes Service (AKS). It simplifies deploying, managing, and operating containerized applications using Kubernetes as a managed service.
Azure Application Gateway is a Layer-7 web traffic load balancer with TLS termination, URL-based routing, cookie-based session affinity, and Web Application Firewall (WAF). It's designed for web applications requiring advanced routing decisions based on HTTP attributes and provides centralized SSL management at the gateway.
Azure Container Registry is a managed, private Docker registry service for storing and managing container images and artifacts. It integrates with AKS, ACI, and App Service, supports geo-replication, webhooks, image scanning via Microsoft Defender, and provides private network access via Private Link for secure deployments.
Azure Fundamentals
What are Azure tags and what are their limitations?
Tags are name/value pairs applied to resources for categorization (e.g., Environment:Production, CostCenter:1234). They appear on invoices for cost allocation, but are not inherited, cannot be used for access control, and are limited to 50 tags per resource with limited character set.
Azure Bastion provides secure RDP and SSH connectivity to VMs directly through the Azure portal over SSL, eliminating the need for public IPs on VMs. It is a fully managed PaaS deployed inside your VNet.
Network Security Groups (NSGs) contain security rules with priority, source, destination, port, and protocol. NSGs attached to subnets or NICs allow or deny traffic, providing stateful filtering inside a VNet.
Azure Queue Storage is a messaging service for storing large numbers of messages that can be accessed from anywhere via authenticated HTTP or HTTPS calls. The maximum size of a single queue message is 64 KB, and a queue can contain millions of messages up to the storage account capacity limit.
Azure Fundamentals
What are Azure Durable Functions?
Azure Functions is a serverless FaaS platform that runs event-driven code without managing infrastructure. It supports C#, JavaScript/TypeScript, Python, Java, PowerShell, and custom handlers, with triggers (HTTP, Timer, Queue, Blob, Event Grid) and bindings for integration.
Operational Excellence emphasizes running workloads reliably through standardized processes, monitoring, automation, continuous improvement, and DevOps practices across the application lifecycle.
The Reliability pillar emphasizes designing workloads that can recover from failures and continue functioning, including availability, recoverability, scalability, and disaster recovery planning.
Durable Functions is an extension of Azure Functions that enables stateful, long-running orchestrations using function chaining, fan-out/fan-in patterns, and async HTTP APIs. State is persisted in Azure Storage, allowing workflows that survive restarts and scale seamlessly.
Azure Fundamentals
What is an Azure Service Level Agreement (SLA) typically expressed as?
An SLA is a formal agreement that defines the performance guarantees Microsoft commits to for an Azure service, usually expressed as a percentage of uptime (e.g., 99.9%).
AIP (part of Microsoft Purview) classifies, labels, and protects documents and emails based on sensitivity. Labels can enforce encryption, watermarks, access restrictions, and visual markings across Office apps, with persistent protection regardless of location.
Landing Zones are pre-architected environments that combine subscription design, networking, identity, governance, and operations to host workloads in a scalable, secure, and compliant manner as part of the Cloud Adoption Framework.
Azure SQL Database is the fully managed PaaS relational database with built-in HA, automatic backups, point-in-time restore, and automatic patching. Alternatives include Azure Database for PostgreSQL, MySQL, and MariaDB flexible servers.
Azure Fundamentals
What is the purpose of Azure Key Vault?
Azure Key Vault safeguards cryptographic keys, secrets (like passwords), and certificates in a hardware-backed, centrally managed cloud service with access control and auditing.
Azure Functions is a serverless compute service that runs code in response to triggers such as HTTP requests, queue messages, or timers. It supports languages including C#, JavaScript, Python, Java, and PowerShell, and you pay only for execution time measured in gigabyte-seconds.
Azure Network Security Groups (NSGs) contain security rules that filter network traffic flowing in and out of network interfaces and subnets. Rules use five-tuple parameters (source, source port, destination, destination port, protocol) and can be configured with default or custom priorities.
Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch connectivity through Azure. It hubs together VPN, ExpressRoute, and point-to-site user VPN connections with routing managed by Microsoft.
Azure Fundamentals
Which Azure service manages DNS domains and provides fast, reliable DNS resolution?
Azure Cost Management + Billing helps organizations monitor, allocate, and optimize Azure spending. It provides cost analysis, budgets, alerts, and recommendations. Free for Azure customers, it offers usage data via APIs, exports, and dashboards, enabling FinOps practices and chargeback/showback across teams and projects.
Landing Zones are pre-architected environments that combine subscription design, networking, identity, governance, and operations to host workloads in a scalable, secure, and compliant manner as part of the Cloud Adoption Framework.
Azure Resource Mover simplifies moving Azure resources between regions or availability zones by handling the discovery, dependency mapping, and orchestrated movement of selected resources.
Azure DNS is a hosting service for DNS domains that provides name resolution using Microsoft's global infrastructure of DNS servers.
Azure Fundamentals
What are the five pillars of the Azure Well-Architected Framework?
Azure Cosmos DB is the recommended globally distributed, multi-model NoSQL database. It offers single-digit millisecond latency, automatic scaling, and supports SQL API, MongoDB, Cassandra, Gremlin, and Table APIs with multi-region writes.
The five pillars are Cost Optimization, Operational Excellence, Performance Efficiency, Reliability, and Security. Each pillar contains design principles and trade-offs to help build high-quality cloud workloads.
Azure Cosmos DB is a globally distributed, multi-model NoSQL database service offering turnkey global distribution, elastic scaling, and guaranteed single-digit millisecond latency at any scale.
Azure Service Bus (topics/subscriptions, AMQP 1.0) and Azure Event Grid (event routing with publish/subscribe and filtering). Service Bus offers FIFO, transactions, and sessions; Event Grid offers near real-time event distribution with retry and dead-lettering.
Azure Fundamentals
What Azure networking component allows inbound and outbound traffic rules for network traffic at the subnet level?
Azure Virtual WAN is a networking service that provides optimized, automated branch-to-branch connectivity through Azure. It hubs together VPN, ExpressRoute, and point-to-site user VPN connections with routing managed by Microsoft.
Reservations are commitments (1 or 3 years) for specific VM SKUs, regions, and other resources, offering up to ~72% discount. Savings Plans are flexible commitments for compute spend across regions/VMs, with up to ~65% discount.
Azure Data Factory is a fully managed, serverless data integration service for orchestrating and automating data movement and transformation at scale. It supports 90+ built-in connectors, visual ETL authoring, SSIS package execution, and hybrid data flows between on-premises and cloud sources and sinks.
Azure Network Security Groups (NSGs) contain security rules that filter network traffic flowing in and out of network interfaces and subnets. Rules use five-tuple parameters (source, source port, destination, destination port, protocol) and can be configured with default or custom priorities.
Azure Fundamentals
What is the purpose of Azure Update Manager?
Azure Blueprints (deprecated for ARM Template Specs/landing zones, but historically) orchestrates the deployment of resource templates, role assignments, and policies to set up governed environments.
Azure Update Manager centralizes assessment and patching of Windows and Linux VMs across Azure, on-premises, and multicloud environments, replacing the legacy Update Management in Automation.
Azure Cosmos DB. It offers globally distributed, multi-model APIs (SQL, MongoDB, Cassandra, Gremlin, Table) with single-digit-millisecond latency and tunable consistency levels.
Azure Traffic Manager is a DNS-based load balancer that distributes traffic optimally to services across global Azure regions using routing methods such as priority, weighted, performance, or geographic.
Azure Fundamentals
What is the purpose of an Azure Resource Group?
Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP). It provides vulnerability assessments, security recommendations, compliance score against standards, and threat protection for VMs, SQL, Storage, and Kubernetes.
Azure Virtual Machine Scale Sets are groups of identical, load-balanced VMs that can automatically increase or decrease in count based on demand or schedule. They integrate with Azure Autoscale to add or remove instances based on metrics like CPU usage or queue length, enabling elastic compute for applications.
Service Health is a personalized dashboard showing Azure service incidents, planned maintenance, and health advisories affecting your subscriptions. It also includes Resource Health for individual resource status and an Action Groups integration for proactive notifications.
A Resource Group is a logical container that holds related Azure resources for an application. Resources in a group share the same lifecycle, permissions, and policies.
Azure Fundamentals
Which Azure service enables centralized log collection across Azure, on-premises, and multi-cloud sources?
Azure Lighthouse enables service providers to manage Azure resources across multiple customer tenants with delegated administration, providing automation, scalability, and governance.
Azure Cosmos DB is optimized for globally distributed, multi-model NoSQL data with millisecond latency, automatic scaling, and turnkey global distribution across Azure regions. It offers multiple APIs including SQL, MongoDB, Cassandra, Gremlin, and Table for flexible data modeling.
Azure Monitor Log Analytics workspace ingests data from Azure resources, agents on on-premises machines, and other clouds. You query data using KQL and correlate logs for diagnostics, dashboards, and alerts.
Advisor's High Availability category recommends actions like configuring Availability Zones, removing single points of failure, and enabling virtual machine scale sets to improve workload uptime and meet SLA targets.
Azure Fundamentals
Which Azure compute service lets you run event-driven code without provisioning or managing servers and supports multiple programming languages?
Azure Information Protection (now part of Microsoft Purview Information Protection) helps organizations classify, label, and protect documents and emails based on sensitivity. It applies persistent protection regardless of where data travels, including encryption, access restrictions, and visual markings like headers and footers.
Azure Container Instances (ACI) provides serverless containers. You supply the image and ACI provisions compute, with no VM or Kubernetes cluster management required, ideal for burst workloads or simple microservice deployments.
Azure Network Security Groups (NSGs) contain security rules that filter network traffic flowing in and out of network interfaces and subnets. Rules use five-tuple parameters (source, source port, destination, destination port, protocol) and can be configured with default or custom priorities.
Azure Functions is a serverless compute service that runs code in response to triggers such as HTTP requests, queue messages, or timers. It supports languages including C#, JavaScript, Python, Java, and PowerShell, and you pay only for execution time measured in gigabyte-seconds.
Azure Fundamentals
What is the maximum size of a single Azure Blob (Block Blob)?
A single block blob in Azure Storage can be up to approximately 4.75 TB (50,000 blocks × 100 MB each, with the latest blocks up to 4000 GB via the 4000 MiB block size limit and append contexts).
The Reliability pillar emphasizes designing workloads that can recover from failures and continue functioning, including availability, recoverability, scalability, and disaster recovery planning.
Reserved Instances (Azure Reservations) provide significant discounts, often up to 72%, compared to pay-as-you-go pricing, when you commit to a 1- or 3-year term.
Azure Monitor Logs (Log Analytics workspace). It ingests data from Azure resources, agents, and connectors, and supports KQL queries, alerts, workbooks, and dashboards, often paired with Microsoft Sentinel for security analytics.
Azure Fundamentals
What is Azure VMware Solution (AVS)?
IaaS (Infrastructure as a Service) provides raw compute, storage, and networking that you manage (e.g., Azure VMs), while PaaS (Platform as a Service) provides managed platforms for applications so you focus only on code and data (e.g., Azure SQL Database).
A Resource Group is a logical container that holds related Azure resources for an application. Resources in a group share the same lifecycle, permissions, and policies.
Traffic Manager is a DNS-based global load balancer that directs traffic using methods: Priority, Weighted, Performance, Geographic, Multivalue, and Subnet. It balances across regions but operates at DNS, not Layer 7.
Azure VMware Solution delivers VMware vSphere-based private clouds in Azure, allowing customers to run VMware workloads natively on Azure infrastructure. It provides seamless migration of VMware environments, preserves existing tooling, and integrates with Azure networking, storage, and identity services for hybrid scenarios.
Azure Fundamentals
What is Azure Cost Management and Billing?
Azure Queue Storage is a messaging service for storing large numbers of messages that can be accessed from anywhere via authenticated HTTP or HTTPS calls. The maximum size of a single queue message is 64 KB, and a queue can contain millions of messages up to the storage account capacity limit.
Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH connectivity to VMs directly through the Azure portal over SSL, eliminating the need for public IP addresses.
Azure Cost Management and Billing helps monitor, allocate, and optimize cloud spending by providing cost analysis, budgets, alerts, and recommendations across subscriptions and resource groups.
Azure Key Vault can store secrets, keys, and certificates. The Premium tier offers HSM-protected keys with FIPS 140-2 Level 3 validation, suitable for regulated workloads requiring hardware-backed key custody.
Azure Fundamentals
Which Azure role-based access control role allows a user to create and manage all resource types but cannot grant access to others?
Cost Management + Billing provides cost analysis, budgets, alerts, and recommendations for Azure spend. It helps organizations monitor usage, forecast costs, enforce budgets, and export data for chargeback or showback reporting.
Azure Cosmos DB is optimized for globally distributed, multi-model NoSQL data with millisecond latency, automatic scaling, and turnkey global distribution across Azure regions. It offers multiple APIs including SQL, MongoDB, Cassandra, Gremlin, and Table for flexible data modeling.
A Resource Group is a logical container that holds related Azure resources for an application. Resources in a group share the same lifecycle, permissions, and policies.
The built-in Contributor role permits creating and managing all Azure resources but does not allow granting access via RBAC. Owner additionally can grant access to other principals within the scope.
Azure Fundamentals
What is Azure Resource Manager (ARM)?
ARM is the deployment and management service for Azure that provides a consistent management layer enabling you to create, update, and delete resources in your Azure account via the portal, CLI, PowerShell, or templates.
Azure Virtual Machine Scale Sets are groups of identical, load-balanced VMs that can automatically increase or decrease in count based on demand or schedule. They integrate with Azure Autoscale to add or remove instances based on metrics like CPU usage or queue length, enabling elastic compute for applications.
VNet peering connects two VNets (same or cross-region) using Microsoft's backbone infrastructure for low-latency, high-bandwidth private connectivity. Peered VNets appear as one for routing, support transitive gateway transit, and do not require public internet or encryption.
An Azure resource group. It holds resources like VMs, storage accounts, and databases that share a common lifecycle, permissions, and policies, and it can contain resources deployed across multiple Azure regions.
Azure Fundamentals
What is the purpose of Azure Dedicated Host?
PPGs co-locate Azure VMs, VM scale sets, and dedicated hosts within a single Azure region to minimize latency between them. They are ideal for low-latency workloads like HPC, gaming, or clustered databases.
Azure Dedicated Host provides physical servers dedicated to a single customer's workloads, giving control over maintenance windows, VM placement, and compliance, while also enabling use of existing on-premises Windows Server or SQL Server licenses through Azure Hybrid Benefit.
The Azure Pricing Calculator lets you estimate the cost of Azure products and services by configuring expected usage scenarios and combining different resource types.
Azure Container Instances is a serverless container service offering fast, isolated containers without managing underlying VMs. It's ideal for short-lived or burst workloads, event-driven processing, simple deployments, and scenarios where you want container execution without the orchestration overhead of Kubernetes clusters.
Azure Fundamentals
What is the Azure Free Account and what does it include?
The Azure Free Account provides new customers $200 in Azure credit for 30 days plus 12 months of select free services (such as 750 hours of B1S Linux VM per month, 5 GB Blob storage, and 250 GB SQL Database) and always-free services including Azure Kubernetes Service and Azure Functions with monthly quotas.
Azure Update Manager centralizes assessment and patching of Windows and Linux VMs across Azure, on-premises, and multicloud environments, replacing the legacy Update Management in Automation.
Blueprints were used to orchestrate deployment of resource groups, policies, RBAC, and ARM templates as a repeatable package. Microsoft has replaced it with landing zone accelerators and recommends using Azure Deployments (Deployment Stacks) with ARM templates and policies.
Azure Kubernetes Service (AKS). It simplifies deploying, managing, and operating containerized applications using Kubernetes as a managed service.
Azure Fundamentals
What is Azure Load Balancer and what types of traffic does it distribute?
Azure DDoS Protection Standard offers enhanced mitigation, real-time metrics, alerting, cost protection guarantees, and SLAs beyond the basic always-on protection included for free.
Azure Load Balancer is a high-performance, low-latency Layer-4 load balancer that distributes inbound and outbound TCP/UDP traffic across healthy service instances. It supports both public load balancing (internet-facing) and internal load balancing (private VNet), and provides high availability for applications.
Azure Service Health provides personalized alerts and guidance for Azure service incidents, planned maintenance, and health advisories affecting your specific subscriptions and resources, helping you plan responses.
Geo-redundant storage (GRS) replicates data to a paired secondary region that is hundreds of miles from the primary region, providing cross-regional disaster recovery.
Azure Fundamentals
What is Azure Bastion and what problem does it solve?
Azure Functions is a serverless compute service that runs code in response to triggers such as HTTP requests, queue messages, or timers. It supports languages including C#, JavaScript, Python, Java, and PowerShell, and you pay only for execution time measured in gigabyte-seconds.
Azure DevOps is a set of development tools supporting the entire DevOps lifecycle. It includes Azure Boards (work tracking), Azure Repos (Git repositories), Azure Pipelines (CI/CD), Azure Test Plans (testing), and Azure Artifacts (package management). It integrates with GitHub and supports any language or platform.
Microsoft Entra ID supports passwordless authentication through protocols like FIDO2, Windows Hello for Business, and Microsoft Authenticator using standards such as WebAuthn.
Azure Bastion is a fully managed PaaS service that provides secure RDP/SSH connectivity to VMs directly through the Azure portal over SSL, eliminating the need for public IP addresses.
Azure Fundamentals
What is Azure Virtual Network (VNet) peering and what does it enable?
Azure VNet peering connects two Azure virtual networks seamlessly, treating them as one network for connectivity purposes. Traffic between peered networks uses Microsoft's private backbone infrastructure, supporting low-latency, high-bandwidth communication without gateways, encryption, or public internet traversal.
A Resource Group is a logical container that holds related Azure resources for an application. Resources in a group share the same lifecycle, permissions, and policies.
Azure VMware Solution delivers VMware vSphere-based private clouds in Azure, allowing customers to run VMware workloads natively on Azure infrastructure. It provides seamless migration of VMware environments, preserves existing tooling, and integrates with Azure networking, storage, and identity services for hybrid scenarios.
Azure Dedicated Host provides physical servers dedicated to a single customer's workloads, giving control over maintenance windows, VM placement, and compliance, while also enabling use of existing on-premises Windows Server or SQL Server licenses through Azure Hybrid Benefit.
Azure Fundamentals
What is Azure App Service?
Azure Reservations require commitment to specific VM size and region for 1 or 3 years, offering up to 72% discount. Savings Plans are more flexible, committing to hourly spend across regions and VM families for 1 or 3 years, offering up to 65% discount while allowing flexibility in resource selection.
Azure DNS is a hosting service for DNS domains that uses Azure's global infrastructure to provide fast, reliable DNS resolution. It supports both public DNS zones for internet-facing resources and private DNS zones for internal VNet name resolution, integrated with Azure RBAC and management tools for seamless administration.
Azure App Service is a fully managed PaaS for building, deploying, and scaling web apps, REST APIs, mobile backends, and automated business processes using .NET, Java, Node.js, Python, PHP, or Ruby.
Region. A region is a set of datacenters deployed within a latency-defined geographic boundary and connected through a dedicated regional low-latency network.
Azure Fundamentals
Which Azure database service is designed for globally distributed, multi-model NoSQL workloads with multi-region writes?
Azure Cosmos DB is a globally distributed NoSQL service offering turnkey global distribution with multi-master writes, consistency models, and sub-10 ms latency for key-value, document, column-family, and graph APIs.
Azure Queue Storage is used for storing large numbers of messages that can be accessed asynchronously by applications, enabling reliable message passing between application components.
Archive tier offers the lowest storage cost for data accessed rarely and stored for at least 180 days. Retrieval is slow (hours) and incurs rehydration and retrieval fees, so it suits long-term backups and compliance archives.
Azure Virtual Desktop is a cloud-based virtual desktop infrastructure (VDI) service that delivers Windows desktops and applications to users from Azure. Benefits include multi-session Windows 10/11, reduced licensing costs via Microsoft 365, simplified management, and global access through any modern device.
Azure Fundamentals
Which Azure networking component provides stateful packet filtering at the network level?
Azure Firewall is a managed, cloud-based network security service that provides stateful packet filtering, application and network-level rules, threat intelligence, and high availability across Availability Zones.
The Security pillar recommends protecting applications and data from threats using confidentiality, integrity, and availability principles, including identity management, encryption, and threat protection.
Azure Traffic Manager is a DNS-based load balancer that distributes traffic optimally to services across global Azure regions using routing methods such as priority, weighted, performance, or geographic.
Application Insights is an APM (Application Performance Monitoring) service that provides distributed tracing, performance counters, failure rates, dependency tracking, and usage analytics for web apps and services. It integrates with Application Performance Index (Apdex) scoring.
Azure Fundamentals
What is Azure Cost Management + Billing used for?
Cost Management + Billing provides cost analysis, budgets, alerts, and recommendations for Azure spend. It helps organizations monitor usage, forecast costs, enforce budgets, and export data for chargeback or showback reporting.
Azure Functions is a serverless compute service that runs event-driven code in response to triggers without requiring infrastructure management, supporting multiple programming languages and bindings.
An NSG contains security rules that allow or deny inbound or outbound network traffic to network interfaces, VMs, or subnets based on 5-tuple (source/destination IP, port, protocol). Rules are evaluated by priority and can use service tags or application security groups.
Azure Event Grid is a fully managed event routing service that uses a publish-subscribe model to deliver events reliably between applications and services. It supports millions of events per second, integrates with Azure services like Functions and Logic Apps, and enables reactive programming with near real-time event delivery.
Azure Fundamentals
What is an Azure Management Group?
PIM provides just-in-time privileged access, requiring approval and providing time-bound elevation for privileged Entra ID roles to reduce standing administrative access risks.
Azure Functions is a serverless compute service that runs code in response to triggers such as HTTP requests, queue messages, or timers. It supports languages including C#, JavaScript, Python, Java, and PowerShell, and you pay only for execution time measured in gigabyte-seconds.
Management groups are containers that organize multiple subscriptions for unified governance. They support hierarchical policy and RBAC inheritance (up to 6 levels deep), enabling enterprise-wide compliance, cost reporting, and access control across many subscriptions.
Horizontal scaling (scale out/in) adds or removes instances, ideal for distributed apps. Vertical scaling (scale up/down) changes instance size (CPU/RAM). Azure Autoscale and VM Scale Sets enable horizontal; resizing a VM enables vertical.
Azure Fundamentals
Which Azure service provides a managed relational database with built-in high availability?
Microsoft Entra ID supports passwordless authentication through protocols like FIDO2, Windows Hello for Business, and Microsoft Authenticator using standards such as WebAuthn.
Azure Monitor Log Analytics workspace ingests data from Azure resources, agents on on-premises machines, and other clouds. You query data using KQL and correlate logs for diagnostics, dashboards, and alerts.
Azure Lighthouse enables service providers to manage Azure resources across multiple customer tenants with delegated administration, providing automation, scalability, and governance.
Azure SQL Database is a fully managed PaaS relational database based on the latest SQL Server engine, offering built-in high availability, automated backups, and intelligent performance tuning.
Azure Fundamentals
What is Azure Queue Storage used for?
Most Azure regions contain three availability zones, though the exact count varies. Each zone is one or more physically separate datacenters with independent power, cooling, and networking within the same region.
Azure Kubernetes Service (AKS). It simplifies deploying, managing, and operating containerized applications using Kubernetes as a managed service.
Azure Queue Storage is used for storing large numbers of messages that can be accessed asynchronously by applications, enabling reliable message passing between application components.
ExpressRoute provides a private, dedicated network connection between on-premises infrastructure and Azure datacenters, offering more reliability, faster speeds, lower latency, and higher security than internet-based VPNs.
Azure Fundamentals
What is Azure Service Bus and how does it differ from Storage Queues?
To find a composite SLA, multiply the individual SLAs (as decimals) of dependent services. For example, two services each with 99.9% availability yield a combined SLA of 99.8%.
Azure Premium SSD managed disks currently support a maximum size of 64 TiB (65,536 GiB) per disk, available through the P50 and larger disk SKUs.
Cost Management + Billing provides cost analysis, budgets, alerts, and recommendations for Azure spend. It helps organizations monitor usage, forecast costs, enforce budgets, and export data for chargeback or showback reporting.
Service Bus is a fully managed enterprise message broker supporting queues (point-to-point) and topics/subscriptions (pub-sub), with features like sessions, dead-lettering, transactions, and FIFO ordering. Storage Queues are simpler, REST-based, larger messages (up to 64KB) and lower cost.
Azure Fundamentals
What is the purpose of Microsoft Entra ID Conditional Access?
Spot VMs use Azure's spare compute capacity at deep discounts (up to 90% off pay-as-you-go), but Microsoft can evict them with 30 seconds' notice when capacity is needed. Suitable for fault-tolerant workloads like batch processing, dev/test, or rendering.
Conditional Access enforces organization-wide policies that evaluate signals like user, location, device, and risk to automate access decisions and enforce security requirements such as MFA.
Azure Functions. It is an event-driven, serverless compute service that lets you run code on demand without provisioning or managing infrastructure.
Azure Service Bus and Event Grid support event-driven messaging. Service Bus queues/topics provide advanced features like dead-lettering, sessions, transactions, and at-least-once delivery for enterprise messaging scenarios.
Azure Fundamentals
What is the purpose of an Azure Application Gateway?
A Private Endpoint brings Azure PaaS services (Storage, SQL, Cosmos DB, etc.) into your VNet via a private IP, so traffic stays on the Microsoft backbone and is not exposed publicly. It enhances data exfiltration protection.
Azure Information Protection (now part of Microsoft Purview Information Protection) helps organizations classify, label, and protect documents and emails based on sensitivity. It applies persistent protection regardless of where data travels, including encryption, access restrictions, and visual markings like headers and footers.
Application Gateway is a layer-7 load balancer providing HTTP/HTTPS routing, TLS termination, session affinity, cookie-based session persistence, URL-based routing, and Web Application Firewall (WAF). It operates at the application level for web traffic.
Geo-redundant storage (GRS) replicates data to a paired secondary region that is hundreds of miles from the primary region, providing cross-regional disaster recovery.
Azure Fundamentals
What is the maximum size of an Azure managed disk (Premium SSD) as of current platform limits?
Azure Load Balancer is a high-performance, low-latency Layer-4 load balancer that distributes inbound and outbound TCP/UDP traffic across healthy service instances. It supports both public load balancing (internet-facing) and internal load balancing (private VNet), and provides high availability for applications.
Azure Premium SSD managed disks currently support a maximum size of 64 TiB (65,536 GiB) per disk, available through the P50 and larger disk SKUs.
Azure Service Health provides personalized alerts and guidance for Azure service incidents, planned maintenance, and health advisories affecting your specific subscriptions and resources, helping you plan responses.
Azure Monitor Logs (Log Analytics workspace). It ingests data from Azure resources, agents, and connectors, and supports KQL queries, alerts, workbooks, and dashboards, often paired with Microsoft Sentinel for security analytics.