Azure AZ-720 cheat sheet

Recovery Services vault backup failures commonly trace to: expired or misconfigured storage account used for instant restore, vault storage redundancy change during backup, or the Azure Backup service lacking network access to the VM (NSG, firewall, private endpoint).

Azure Site Recovery replication health states: Critical (replication stopped, RPO breached), Warning (degraded but progressing), Healthy. Check Recovery Points and the Events/Jobs blade for the failing step before re-enabling protection.

ASR configuration server / mobility service version mismatch blocks replication; the mobility agent must match the configuration server version, and the appliance must be able to reach the Azure Site Recovery endpoints over HTTPS 443.

Geo-redundant storage protects against regional failure; locally redundant storage does not. Zone-redundant storage protects against zone failure. Vault redundancy cannot be changed while protected items exist - remove or re-protect items first.

Soft delete retains deleted backup data for 14 days by default (extendable); if a VM's backups appear missing, verify whether soft delete or a vault deletion occurred rather than assuming data loss.

RPO in ASR equals the replication frequency setting (as low as 30 seconds for VMware/Hyper-V enhanced policy). RTO depends on failover runbooks, boot time, and DNS/IP reconfiguration, not replication frequency alone.

Backup of Azure Files requires the storage account to be in the same region as the vault and reachable; failure 'storage account not found' usually indicates the storage account is in a different subscription or has network restrictions.

Azure Backup supports up to 100 protected instances per vault policy by default and 500 policies per vault; policy assignment failures at scale often reflect these quota limits.

ExpressRoute circuit states: Enabled/Disabled is the administrative state; Provider status (Provisioned/Not provisioned) reflects the connectivity provider; Circuit status (Enabled/Disabled). A circuit stuck at 'Not provisioned' means the provider has not completed Layer 2 provisioning.

ExpressRoute GatewaySubnet must be /27 or larger (recommended) and must not contain other resources; a /29 or smaller gateway subnet blocks gateway creation for high-performance or ErGw3AZ SKUs.

VPN Gateway SKU determines tunnel count and throughput; Basic SKU does not support active-active, IKEv2-only, or coexistence with ExpressRoute. VpnGw1 and above are required for those features.

Site-to-site VPN troubleshooting order: local network gateway address space matches on-premises subnets, shared key matches both sides, IKE/IPsec parameters match (IKEv2 vs IKEv1), and NSGs allow UDP 500/4500 and ESP.

BGP peer status in a VPN or ExpressRoute gateway shows 'Connected' only when the BGP session is established; 'Connecting' with traffic still flowing indicates a stale session or asymmetric routing.

Azure Virtual WAN hubs require a hub address prefix that does not overlap with any connected VNet or branch address space; overlapping prefixes silently drop routes.

DNS resolution across hybrid links fails if on-premises DNS forwarders cannot reach Azure DNS private resolver inbound endpoints (UDP/TCP 53) or if the private DNS zone is not linked to the VNet.

Connection monitor and Network Watcher topology reveal whether packets are dropped by NSG, UDR, or the gateway; asymmetric routing (traffic returns on a different path) is the most common cause of intermittent hybrid failures.

App Service 'Application Error' with HTTP 500 often indicates a startup failure: check the container/app logs, the WEBSITE_STARTUP_TIME, and whether the app is listening on the port specified by the PORT/WEBSITES_PORT environment variable.

App Service health check requires a path returning 200; failing health checks cause instance replacement, not scale-out, and can appear as intermittent 502/503 responses.

Azure SQL 'Login failed for user' with a valid credential usually means the client IP is not in the server firewall rules, the database is in a different logical server, or the connection used a private endpoint without DNS resolution.

Azure SQL connection timeouts under load often reflect exhausted connection pools or DTU/vCore limits; check the resource utilization metrics and the sys.dm_db_resource_stats equivalent before scaling.

Azure Functions consumption plan cold starts and timeouts: default timeout is 5 minutes (10 minutes max on consumption, 30 minutes on Premium); 'Function host is not running' indicates a startup exception or missing dependency.

Cosmos DB 429 responses indicate rate limiting by RU/s; 449 indicates a write conflict. Partition key hot spots produce 429s concentrated on one logical partition even when total RU/s is sufficient.

Service Bus dead-lettering occurs after max delivery count (default 10) or message TTL expiry; check DeadLetterReason and DeadLetterErrorDescription rather than assuming a transport failure.

Storage 'AuthorizationFailure' with a valid SAS usually means the SAS start/expiry window, IP restriction, or allowed protocols do not match the request; check each SAS field, not just the signature.

Conditional Access blocks appear as AADSTS50076 (MFA required), AADSTS50079 (MFA enrollment required), AADSTS53003 (blocked by CA policy), or AADSTS50105 (user not assigned to the application). The error code identifies the policy type.

Insufficient privileges on a resource with a valid identity usually means the role assignment is at the wrong scope or the token was issued before the assignment propagated; tokens cache role claims for up to 1 hour.

Managed identity token failures: system-assigned identity is deleted with the resource; user-assigned identity must be explicitly attached. IMDS endpoint 169.254.169.254 must be reachable and not blocked by firewall.

Service principal secret/certificate errors: AADSTS7000215 (invalid client secret) and AADSTS700027 (certificate not found) indicate expired or mismatched credentials; check the app registration's certificate thumbprint and expiry.

On-premises AD DS authentication to Azure Files requires line-of-sight to a domain controller, a synced identity, and the storage account's Kerberos domain setting; 'access denied' often reflects a missing NTFS or share-level permission.

PIM activation failures: eligible assignments require activation with justification and MFA; the role is not effective until activation completes, which can take several minutes.

Azure RBAC does not grant data-plane access to storage, Key Vault, or Cosmos DB unless the role is a data-plane role (for example, Storage Blob Data Contributor) or the resource uses shared-key authorization.

AAD Connect sync errors: 'export error' with 'permission-issue' usually means the AD connector account lacks the required delegated permissions; check the Synchronization Service Manager connector space for the failing object.

NSG evaluation order: inbound rules are evaluated by priority (lowest number first) and the first match wins; the default rules (AllowVnetInBound 65000, AllowAzureLoadBalancerInBound 65001, DenyAllInBound 65500) apply only after custom rules.

UDR (route table) overrides system routes; a 0.0.0.0/0 route to a virtual appliance or 'None' next hop blackholes traffic. Check the effective routes on the NIC, not the route table alone.

Azure Firewall and NVA forced tunneling requires the GatewaySubnet route table to have a 0.0.0.0/0 route to the firewall; without it, the gateway cannot forward traffic to the internet.

VNet peering is non-transitive: a peered VNet does not automatically reach a VNet peered to its peer. Use a hub-and-spoke gateway or Azure Virtual WAN for transitive routing.

Private endpoint DNS resolution requires a private DNS zone linked to the VNet (privatelink...azure.com) or a DNS forwarder; missing links produce public IP resolution and connection failures.

Network Watcher connection troubleshoot tests a 5-tuple path and reports the blocking NSG rule, next hop type, and latency; IP flow verify tests a single direction only.

Azure Load Balancer health probe failures: the probe source is 168.63.129.16; NSGs must allow it, and the backend must respond on the probe port and protocol (TCP or HTTP) within the configured interval.

Azure DNS private zones can be linked to a VNet with auto-registration; overlapping names in multiple zones linked to the same VNet resolve unpredictably, so keep zone names unique per VNet.

RDP/SSH failure triage order: VM power state (running vs stopped/deallocated), boot diagnostics screenshot, NSG rules on the subnet and NIC, then the guest OS firewall and the RDP/SSH service state.

Boot diagnostics capture a screenshot and serial log; a 'boot error' screenshot distinguishes an OS-level failure from a network-level failure, so check it before changing NSG rules.

Azure Serial Console and the Run Command feature allow guest access when RDP/SSH is blocked; Run Command requires the VM agent (WindowsAzureGuestAgent / walinuxagent) to be healthy.

Reset password / reset configuration via the portal requires the VM agent; if the agent is unresponsive, redeploy the VM (which moves it to a new host) before rebuilding.

Accelerated networking requires a supported VM size and OS; enabling it on an unsupported size fails at NIC creation, not at boot.

Just-in-time (JIT) VM access in Defender for Cloud opens NSG rules temporarily; if RDP fails after JIT, verify the request is approved and the source IP matches the request.

Windows VM boot loop or 'Getting ready' hang often reflects a failed update or a full OS disk; check the serial log for 'STOP' codes and verify the OS disk has free space.

Private IP changes after a stop/deallocate when the NIC uses dynamic allocation; use static private IPs or a load balancer for stable connectivity to backend VMs.