Azure AZ-204 key terms

A serverless compute service that runs event-driven code without you managing servers. You write small functions that execute in response to a trigger, scale automatically, and on the Consumption plan are billed per execution and execution time.

An extension of Azure Functions for writing stateful workflows in code. Orchestrator functions coordinate activity functions, checkpoint progress, and support patterns such as chaining, fan-out/fan-in, human interaction, and long-running timers.

A trigger declares the event that starts a function, while bindings declaratively connect the function to other resources for input or output. Bindings reduce the amount of client SDK plumbing code you must write.

The pricing and scaling model that hosts a function app. Consumption scales to zero and bills per execution, Premium adds pre-warmed instances and virtual network integration, and Dedicated runs on reserved App Service compute.

The latency incurred when a serverless platform must provision a new instance and load your code before the first request executes. Premium plans, pre-warmed instances, and keeping code lean help mitigate it.

A named live copy of an App Service app with its own hostname, letting you deploy and validate a build, then swap it into production with minimal downtime. Swapping also warms up the incoming instance.

The set of compute resources, defined by tier, virtual machine size, and instance count, that hosts one or more App Service apps. Apps in the same plan share those resources and the billed cost.

A private, Azure-hosted registry for storing and managing container images and OCI artifacts. Images can be built with registry tasks, and access can be authenticated using service principals or managed identities.

A serverless container runtime that starts a container in seconds with no orchestrator or virtual machine management. Billing is per second for CPU and memory, which suits short-lived or burst workloads.

A declarative domain-specific language for deploying Azure resources. It compiles to ARM JSON templates, supports modules and loops, and provides type safety and cleaner syntax than hand-written JSON.

A setting on a blob that trades storage cost against access cost and latency: hot for frequent reads, cool for infrequent access, cold for rarely used data, and archive for offline data that must be rehydrated before reading.

A rule set that automatically moves blobs between access tiers or deletes them based on age or last-modified conditions. Rules run about once per day and can be scoped to a storage account or filtered by prefix.

A signed URL granting time-limited, scoped access to storage resources with specific permissions such as read or write. User delegation SAS is signed with Entra ID credentials; service and account SAS use account keys.

A server-side policy on a container, queue, table, or file share defining start time, expiry, and permissions. A service SAS can reference the policy, so access can be revoked or adjusted without reissuing URLs.

The .NET SDK for Blob Storage exposing BlobServiceClient, BlobContainerClient, and BlobClient objects used to upload, download, list, and set metadata or properties on blobs and containers.

A durable message queue holding millions of small messages for asynchronous work between components. Workers pull messages, which become invisible while being processed, and a dequeue count supports retry and poison handling.

The property that determines which logical partition stores an item in Cosmos DB, driving data distribution and query efficiency. Queries that include the partition key avoid expensive cross-partition fan-out.

The normalized currency of throughput in Cosmos DB, expressing the cost of operations such as reads and writes. Provisioned or serverless request unit consumption determines available capacity and when requests get throttled.

A Cosmos DB setting balancing read freshness against latency and availability, ranging from strong through bounded staleness, session, and consistent prefix to eventual. Stronger levels consume more request units and limit write regions.

An ordered, persistent log of item changes in a Cosmos DB container that consumers read incrementally. It supports event-driven processing, denormalization, and cache refresh patterns without polling the whole container.

Microsoft's cloud identity provider that authenticates users and applications and issues tokens for Azure and Microsoft 365. It supports OAuth 2.0, OpenID Connect, conditional access, and app registrations.

An automatically managed identity in Entra ID assigned to an Azure resource, letting code obtain tokens without storing secrets. System-assigned identities live with the resource; user-assigned identities are standalone and shareable.

The security object created in Entra ID when an application is registered, representing that app's identity for authentication and authorization. It can be granted roles and used in client credential flows.

A role-based authorization system for Azure control-plane access. Role definitions list allowed actions and are assigned to security principals at a scope such as management group, subscription, resource group, or resource.

A managed service for storing and controlling access to secrets, encryption keys, and certificates. It offers soft delete, purge protection, access policies or RBAC, and logging of secret and key usage.

A special syntax in App Service and App Configuration settings that resolves to a Key Vault secret at runtime, so secrets are never stored in app settings. The app's managed identity needs permission to read the secret.

A family of client libraries that acquire tokens from the Microsoft identity platform for users and applications, handling token caching, refresh, and multiple authentication flows such as authorization code or client credentials.

A managed service for centralizing application settings and feature flags. It supports labels, key-value revisions, Key Vault references, and feature filters that client libraries can refresh without redeploying the app.

An application performance monitoring feature of Azure Monitor that collects requests, dependencies, exceptions, traces, and custom metrics. It provides live metrics, distributed tracing, availability tests, and log-based analytics.

The umbrella platform for collecting platform metrics, resource logs, and activity data in Azure, with alerting, dashboards, and query capabilities over Log Analytics workspaces.

Kusto Query Language, used to query Azure Monitor logs and other tabular data stores. Queries pipe results through operators such as where, summarize, join, and project to analyze telemetry.

A technique that reduces Application Insights telemetry volume by keeping only a percentage of items while preserving statistically correct counts. Adaptive sampling adjusts automatically, while fixed-rate sampling keeps cost predictable.

Tracking one logical operation across services by propagating a correlation identifier, so Application Insights can assemble an end-to-end transaction view showing dependencies, durations, and failures.

A resilience pattern in which failed transient operations are retried after progressively longer delays, usually with jitter and a maximum attempt count, to avoid overwhelming a recovering dependency.

A managed in-memory data store used for caching, session state, and fast lookups to reduce load on back-end databases. Tiers add replication, clustering, and data persistence options.

A gateway service that publishes, secures, throttles, and monitors APIs. It exposes backends through products and subscriptions, applies policies, and can cache responses or validate tokens before requests reach the backend.

An XML-defined rule executed in the inbound or outbound pipeline of API Management, such as rate limiting, JWT validation, response transformation, or caching. Policies apply at global, product, API, or operation scope.

A publish/subscribe messaging construct where publishers send to a topic and each subscription receives its own copy filtered by rules. It supports sessions, dead-lettering, duplicate detection, and peek-lock receive.

A push-based event routing service for discrete, reactive scenarios. Publishers emit events to topics, and subscriptions deliver them to handlers such as functions or webhooks with filtering and automatic retries.

A high-throughput streaming ingestion service for millions of events per second, organized into partitions and consumer groups. It speaks the Kafka protocol and feeds telemetry pipelines and stream processing jobs.