Azure AZ-204 cheat sheet

Azure Functions hosting: Consumption plan scales dynamically and bills per execution; Premium adds pre-warmed instances and VNet integration; Dedicated App Service plan runs on always-ready instances.

A function has exactly one trigger; input and output bindings are optional declarative connections to data sources.

Durable Functions patterns: function chaining, fan-out/fan-in, async HTTP APIs, monitoring, human interaction, and aggregator.

Durable orchestrator code must be deterministic: no DateTime.Now, Guid.NewGuid, random values, or direct I/O; call activity functions for side effects.

App Service deployment slots support swap; slot settings marked sticky remain with the slot, while other settings move with content.

Azure Container Instances bills per second and has restart policies Always, OnFailure, and Never; it provides no built-in orchestrator.

WebJobs run only inside App Service; continuous WebJobs always run, while triggered WebJobs start manually or on a schedule.

Consumption plan function timeout defaults to 5 minutes and can be set to a maximum of 10 minutes.

Blob types: block blobs for large files, append blobs for append-only logs, page blobs for random-access VHDs.

A block blob supports up to 50,000 committed blocks and a maximum size of about 190.7 TiB.

Blob tiers: Hot, Cool with a 30-day minimum, Cold with a 90-day minimum, Archive with a 180-day minimum and rehydration latency.

A user delegation SAS is secured with Microsoft Entra ID credentials, applies to blobs only, and has a maximum validity of seven days.

A stored access policy on a container defines start time, expiry, and permissions for a service SAS and can be changed to revoke access.

A blob lease is infinite or 15 to 60 seconds; writes with a lease require the lease ID, and breaking a lease uses a break period.

Cosmos DB consistency levels strongest to weakest: Strong, Bounded staleness, Session, Consistent prefix, Eventual.

Azure Queue storage messages are at most 64 KiB and visibility timeout can be at most 7 days.

Table storage entity group transactions are atomic, max 100 entities, and require the same PartitionKey.

System-assigned managed identity lifecycle follows the Azure resource; user-assigned managed identity is standalone and can be attached to multiple resources.

DefaultAzureCredential tries environment variables, managed identity, and developer tool credentials in sequence and uses the first success.

Key Vault permission models are Azure RBAC at vault scope and vault access policies granting key, secret, and certificate permissions.

Key Vault certificates contain a key and a secret; secrets store strings, and keys are cryptographic key objects.

Microsoft identity platform access tokens authorize API calls; ID tokens identify the signed-in user to a client application.

App Service authentication (Easy Auth) can require authentication before app code runs and supports Entra ID, Google, Facebook, and other providers.

Azure RBAC assignments apply at management group, subscription, resource group, or resource scope; deny assignments override allow assignments.

Disabling shared key access on a storage account forces clients to authenticate with Microsoft Entra ID or SAS tokens.

A service SAS can be tied to a stored access policy for revocation; account SAS is signed with the account key.

Application Insights telemetry types include requests, dependencies, exceptions, traces, events, and metrics.

Sampling reduces telemetry volume; adaptive sampling adjusts rate automatically, fixed-rate sampling uses a set percentage, ingestion sampling occurs at the endpoint.

An Application Insights connection string identifies the resource and ingestion endpoint and replaces the instrumentation key.

KQL operators include where for filtering, project for column selection, summarize for aggregation, extend for computed columns, and join for combining tables.

Azure Monitor metrics are numeric time-series for near-real-time alerting; logs are stored in a Log Analytics workspace and queried with KQL.

App Service diagnostics include Auto-heal rules, crash dumps, Kudu, log stream, and App Service logs to filesystem, blob, or Log Analytics.

Azure Cache for Redis eviction policies such as volatile-lru and allkeys-lru decide which keys are removed when maxmemory is reached.

Autoscale rules scale out or in based on metrics or schedules and use a cooldown period before another scale action.

Transient fault handling uses retries with exponential backoff and jitter, plus circuit breakers, and operations should be idempotent.

API Management policies execute inbound, backend, outbound, and on-error; policy scopes are global, product, API, and operation.

API Management subscriptions pass a key in the Ocp-Apim-Subscription-Key header or query string, depending on configuration.

Event Grid routes discrete events with filtering and retries; Event Hubs ingests high-throughput streaming telemetry; Service Bus provides enterprise queues and topics.

Service Bus queues are point-to-point; topics with subscriptions provide pub-sub, and subscriptions can use SQL, correlation, or true/false filters.

Service Bus receive modes are peek-lock, which requires complete or abandon, and receive-and-delete, which removes the message immediately.

Event Hubs ordering is guaranteed only within a partition; consumer groups track independent offsets, and checkpoints are stored in a storage account.

Azure Functions bindings connect to Service Bus, Event Hubs, Storage Queues, and other services without writing client SDK code.

Microsoft Graph is called with a Microsoft Entra ID access token and exposes REST endpoints such as /me and /users.