Free Azure AZ-900 Exam Flashcards

The delivery of computing services including servers, storage, databases, networking, software, and analytics over the internet ('the cloud'). Cloud computing offers faster innovation, flexible resources, and economies of scale, allowing organizations to pay only for the cloud services they use, helping lower operating costs and scale as business needs change.

A framework defining security responsibilities between cloud providers and customers. Microsoft manages security OF the cloud (physical infrastructure, network, hypervisor), while customers manage security IN the cloud (data, access, applications). The division varies by service type: IaaS requires more customer responsibility than PaaS or SaaS.

Cloud resources owned and operated by third-party providers like Microsoft Azure, delivered over the public internet and shared among multiple organizations. Benefits include no capital expenditure, pay-as-you-go pricing, near-unlimited scalability, and high reliability. Organizations don't manage the underlying infrastructure.

Cloud computing resources used exclusively by a single organization, hosted either on-premises or by a third party. Provides greater control and customization, enhanced security for sensitive data, and supports legacy applications. Requires higher capital expenditure and IT expertise to maintain.

A computing environment combining public and private clouds, allowing data and applications to be shared between them. Provides flexibility to run workloads where most appropriate, enables cloud bursting for peak demand, maintains compliance for sensitive data on-premises, and supports gradual cloud migration strategies.

A pricing model where you pay only for the resources you use, eliminating upfront infrastructure costs. Benefits include no wasted resources, ability to scale up or down based on demand, and operational expenditure (OpEx) instead of capital expenditure (CapEx). Azure meters track usage for accurate billing.

Cloud service model providing virtualized computing resources over the internet. The provider manages hardware, networking, and virtualization while customers manage OS, middleware, and applications. Azure Virtual Machines is an example. Offers maximum flexibility and control but requires more management effort.

Cloud service model providing a platform for developing, running, and managing applications without managing underlying infrastructure. Azure App Service and Azure SQL Database are examples. Reduces development time, provides built-in scalability, and eliminates OS patching responsibilities.

Cloud service model delivering fully managed applications over the internet on a subscription basis. Microsoft 365 and Dynamics 365 are examples. Users simply access software via browser with no installation, updates, or infrastructure management required. Provides predictable costs and automatic updates.

The ability of a system to remain operational and accessible with minimal downtime, typically measured as a percentage (e.g., 99.99% uptime). Azure achieves this through redundant systems, availability zones, load balancing, and automatic failover. Service Level Agreements (SLAs) define guaranteed uptime levels.

The ability to adjust resources to meet demand. Vertical scaling (scaling up) adds more CPU, RAM, or storage to existing resources. Horizontal scaling (scaling out) adds more instances of resources. Azure provides both manual and automatic scaling options to optimize performance and cost.

A cloud execution model where the provider dynamically manages server allocation. Azure Functions is the primary serverless compute service. You write code that runs in response to events without provisioning servers, paying only for execution time. Enables rapid development and automatic scaling to zero when idle.

Geographical areas containing one or more datacenters that are nearby and networked together with low-latency connectivity. Azure has 60+ regions worldwide, more than any other cloud provider. Choose regions based on proximity to users, data residency requirements, service availability, and compliance needs.

Two Azure regions within the same geography paired for disaster recovery and business continuity. Region pairs are at least 300 miles apart to minimize impact from regional disasters. Updates are rolled out sequentially to pairs, and data residency is maintained within the geography for compliance.

Physically separate locations within an Azure region, each with independent power, cooling, and networking. Designed to protect against datacenter failures with 99.99% VM uptime SLA when deployed across zones. Connect zones with high-speed, private fiber-optic networks. Not all regions have availability zones.

Logical containers for Azure resources deployed together. Resources can only belong to one resource group. Used to organize resources by lifecycle, permissions, or project. Deleting a resource group deletes all contained resources. Apply role-based access control (RBAC) at the resource group level.

A logical unit of Azure services linked to an Azure account, providing authenticated and authorized access to Azure resources. Used as billing boundary and access control boundary. Organizations often use multiple subscriptions to separate environments, departments, or billing. Each subscription has resource limits.

Containers for organizing subscriptions into a hierarchy for unified policy and access management. Apply Azure Policy or RBAC at management group level to inherit across all child subscriptions. Up to six levels of depth supported. Root management group contains all subscriptions in a directory.

The deployment and management service for Azure, providing a consistent management layer for all resource operations. ARM templates enable infrastructure as code with declarative JSON syntax. Benefits include dependency management, tagging, RBAC integration, and the ability to redeploy entire environments consistently.

Azure regions isolated from the main Azure cloud to meet specific compliance and regulatory requirements. Examples include Azure Government (US government agencies) and Azure China (operated by 21Vianet). These regions have separate instances of Azure with dedicated infrastructure and compliance certifications.

Physical facilities containing Azure's computing infrastructure, including servers, networking equipment, and storage systems. Datacenters feature advanced security, cooling systems, and redundant power. Multiple datacenters within a region provide fault tolerance. Microsoft operates over 200 datacenters globally.

Azure's organizational structure from top to bottom: Management Groups, Subscriptions, Resource Groups, and Resources. Policies and access controls applied at higher levels are inherited by lower levels. This hierarchy enables efficient governance, compliance, and cost management across large organizations.

IaaS compute service providing on-demand, scalable virtual servers in the cloud. Choose from Windows or Linux operating systems with various sizes optimized for compute, memory, storage, or GPU workloads. Pay by the minute with options for reserved instances (up to 72% savings) or spot instances for interruptible workloads.

Azure service that creates and manages a group of identical, load-balanced VMs. Automatically increases or decreases VM instances based on demand or schedule. Supports up to 1,000 VMs with Azure images or 600 with custom images. Ideal for large-scale services like web servers, batch processing, and big data.

PaaS offering for building and hosting web apps, REST APIs, and mobile backends without managing infrastructure. Supports .NET, Java, Node.js, Python, PHP, and Ruby. Features include auto-scaling, CI/CD integration, custom domains, SSL certificates, and deployment slots for staging. Pay based on App Service Plan tier.

Serverless compute service for running event-driven code without provisioning servers. Triggers include HTTP requests, timers, queues, and database changes. Supports C#, JavaScript, Python, Java, and PowerShell. Consumption plan charges only for execution time and memory used. Durable Functions enable stateful workflows.

Fastest and simplest way to run containers in Azure without managing virtual machines or orchestration. Start containers in seconds with per-second billing. Ideal for simple applications, task automation, and build jobs. Supports Linux and Windows containers with configurable CPU and memory.

Managed Kubernetes container orchestration service that simplifies deploying, managing, and scaling containerized applications. Azure handles critical tasks like health monitoring, maintenance, and upgrades. Integrates with Azure Active Directory, Azure Monitor, and Azure Policy. No charge for cluster management, only pay for nodes.

Desktop and app virtualization service running in the cloud, delivering full Windows 11/10 desktops or published applications. Supports multi-session Windows, optimized for Microsoft 365 apps. Enables secure remote work from any device. Reduces costs with per-user licensing and centralized management.

Object storage solution optimized for storing massive amounts of unstructured data like images, videos, logs, and backups. Access tiers include Hot (frequent access), Cool (infrequent, 30-day minimum), Cold (rare access, 90-day minimum), and Archive (offline, 180-day minimum). Supports automatic lifecycle management policies.

Fully managed file shares in the cloud accessible via SMB (Server Message Block) and NFS (Network File System) protocols. Can be mounted concurrently by cloud and on-premises deployments. Azure File Sync caches shares on Windows Servers for fast local access. Ideal for lift-and-shift migrations.

Fully managed PaaS relational database engine based on the latest stable SQL Server version. Handles patching, backups, and monitoring automatically. Features include built-in AI for performance tuning, geo-replication for disaster recovery, and serverless tier for intermittent workloads with auto-pause capability.

Globally distributed, multi-model NoSQL database service with single-digit millisecond response times. Supports key-value, document, column-family, and graph data models. Offers multiple consistency levels from strong to eventual. Provides turnkey global distribution with multi-region writes and 99.999% availability SLA.

Fundamental building block for private networks in Azure, enabling secure communication between Azure resources, internet, and on-premises networks. Features include subnets for segmentation, network security groups for filtering, VNet peering for cross-VNet connectivity, and service endpoints for secure access to Azure services.

Virtual network gateway for sending encrypted traffic between Azure VNet and on-premises networks over the public internet (Site-to-Site VPN) or connecting individual devices (Point-to-Site VPN). Supports IKEv2 and SSTP protocols. Multiple gateway SKUs available for different bandwidth and feature requirements.

Private, dedicated connection between on-premises infrastructure and Azure datacenters, not traversing the public internet. Offers more reliability, faster speeds (up to 100 Gbps), consistent latency, and higher security. Requires connectivity provider partnership. Ideal for large-scale data transfers and hybrid architectures.

Cloud-based identity and access management service for signing in and accessing Microsoft cloud services, custom apps, and third-party SaaS applications. Features include single sign-on (SSO), multifactor authentication (MFA), conditional access policies, and B2B/B2C identity management. Different from on-premises Active Directory.

Security method requiring two or more verification factors: something you know (password), something you have (phone/token), or something you are (biometrics). Microsoft Entra MFA significantly reduces risk of unauthorized access. Can be enforced through conditional access policies based on user, location, or device risk.

Authorization system providing fine-grained access management for Azure resources. Assign roles (Owner, Contributor, Reader, or custom) to users, groups, or service principals at different scopes (management group, subscription, resource group, or resource). Follows principle of least privilege for security.

Security framework assuming breach and verifying each request regardless of origin. Core principles: verify explicitly (always authenticate and authorize), use least privilege access, and assume breach (minimize blast radius and segment access). Microsoft implements Zero Trust across identity, endpoints, apps, data, infrastructure, and networks.

Layered security approach with multiple barriers protecting data. Layers include physical security (datacenters), identity and access (authentication), perimeter (DDoS protection), network (segmentation, NSGs), compute (endpoint protection), application (secure code), and data (encryption). If one layer fails, others continue protecting.

Cloud-native application protection platform (CNAPP) providing security posture management and threat protection. Continuously assesses resources for vulnerabilities, provides secure score and recommendations, and detects threats across Azure, hybrid, and multi-cloud environments. Free tier includes continuous assessments; advanced features require Defender plans.

Service for creating, assigning, and managing policies that enforce rules and effects on resources. Ensures compliance with corporate standards and SLAs. Built-in policies include requiring tags, restricting VM sizes, or enforcing encryption. Policy initiatives group related policies. Non-compliant resources can be denied or audited.

Protection mechanism preventing accidental deletion or modification of critical Azure resources. Two lock types: CanNotDelete (authorized users can read and modify but not delete) and ReadOnly (authorized users can read only). Locks are inherited from parent scopes. Only Owners and User Access Administrators can manage locks.

Web-based tool for estimating monthly Azure costs before deployment. Configure products, regions, tiers, and support options to generate detailed cost estimates. Save and share estimates, compare scenarios, and export to Excel. Essential for budgeting and planning cloud migrations or new projects.

Suite of tools for monitoring, allocating, and optimizing cloud costs. Features include cost analysis with customizable views, budgets with alerts, recommendations for cost savings, and anomaly detection. Supports Azure, AWS, and Google Cloud. Helps organizations understand spending patterns and reduce waste.

Name-value pairs for organizing and categorizing Azure resources for billing, management, and governance. Apply tags to resources, resource groups, or subscriptions. Common uses include cost center allocation, environment identification (dev/test/prod), and owner tracking. Tags are not inherited by default.

Microsoft's formal commitment defining performance standards and uptime guarantees for Azure services. Most services offer 99.9% to 99.99% availability. Composite SLA for multi-service architectures is calculated by multiplying individual SLAs. Service credits are provided when SLAs are not met. Free services have no SLA.

Personalized cloud consultant providing recommendations to optimize Azure deployments. Analyzes configurations and usage to provide actionable suggestions across five categories: Reliability, Security, Performance, Cost, and Operational Excellence. Recommendations are prioritized by impact and include estimated savings.

Comprehensive monitoring solution for collecting, analyzing, and responding to telemetry from Azure and on-premises environments. Components include Metrics (numerical data), Logs (Log Analytics queries), Alerts (notifications and automated actions), and Application Insights (application performance monitoring). Enables proactive issue identification.