Azure AZ-720 flashcards
Azure AZ-720 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Azure Backup soft delete
- Retains deleted backup data for 14 days by default, extendable to 180 days. Missing recovery points after a vault deletion are usually recoverable within this window.
- ASR replication health states
- Critical means replication has stopped and the RPO is breached. Warning means degraded but progressing. Healthy means replication is current. Check the Events blade for the failing step.
- Vault redundancy change constraint
- A Recovery Services vault's storage redundancy cannot be changed while protected items exist. Remove or re-protect items, or create a new vault, before changing redundancy.
- ASR RPO versus RTO
- RPO equals the replication frequency, as low as 30 seconds. RTO depends on failover runbooks, boot time, and DNS/IP reconfiguration, not on replication frequency alone.
- Mobility service version mismatch
- The mobility agent on each protected server must match the configuration server version. A mismatch blocks replication even when network connectivity to Azure is healthy.
- Backup policy quota limits
- A Recovery Services vault supports up to 500 backup policies and 100 protected instances per policy by default. Assignment failures at scale often reflect these limits.
- ExpressRoute circuit provisioning states
- Provider status Provisioned means the connectivity provider finished Layer 2 provisioning. Circuit status Enabled means the circuit is administratively active. Not provisioned means the provider has not completed setup.
- GatewaySubnet size requirement
- The GatewaySubnet should be /27 or larger and must contain no other resources. Smaller subnets block high-performance or ErGw3AZ gateway SKUs and cause gateway creation failures.
- VPN Gateway Basic SKU limits
- The Basic SKU does not support active-active, IKEv2-only, or coexistence with ExpressRoute. Use VpnGw1 or higher for those features and for higher throughput.
- Site-to-site VPN checklist
- Verify the local network gateway address space matches on-premises subnets, the shared key matches both sides, IKE/IPsec parameters match, and NSGs allow UDP 500/4500 and ESP.
- VNet peering transitivity
- VNet peering is non-transitive: a peered VNet cannot reach a VNet peered to its peer. Use a hub-and-spoke gateway or Azure Virtual WAN for transitive routing.
- Private endpoint DNS requirement
- Private endpoint resolution needs a linked private DNS zone such as privatelink.<service>.<region>.azure.com, or a DNS forwarder. Without it, clients resolve the public IP and connections fail.
- Asymmetric routing symptom
- Traffic leaves through one path and returns through another, so stateful devices drop the return packets. It is the most common cause of intermittent hybrid connectivity failures.
- App Service startup error
- HTTP 500 at startup usually means the app is not listening on the expected port. Check app logs and the PORT or WEBSITES_PORT environment variable the platform expects.
- App Service health check behavior
- A failing health check path causes instance replacement, not scale-out, and can appear as intermittent 502 or 503 responses. The path must return HTTP 200.
- Azure SQL firewall login failure
- A valid credential that still fails to log in usually means the client IP is not in the server firewall rules, the database is on another logical server, or private endpoint DNS is unresolved.
- Functions timeout defaults
- Consumption plan timeout defaults to 5 minutes and maxes at 10 minutes. Premium plan maxes at 30 minutes. Host-not-running errors indicate a startup exception or missing dependency.
- Cosmos DB 429 response
- HTTP 429 means requests are rate limited by RU/s. A hot partition key concentrates 429s on one logical partition even when total provisioned RU/s is sufficient.
- Service Bus dead-letter reason
- Messages dead-letter after the max delivery count, default 10, or after TTL expiry. Read DeadLetterReason and DeadLetterErrorDescription instead of assuming a transport failure.
- Storage SAS authorization failure
- AuthorizationFailure with a valid SAS usually means the start or expiry window, IP restriction, or allowed protocol does not match the request. Check every SAS field, not just the signature.
- Conditional Access error codes
- AADSTS50076 means MFA required, AADSTS50079 means MFA enrollment required, AADSTS53003 means blocked by policy, and AADSTS50105 means the user is not assigned to the application.
- Role assignment token caching
- Tokens cache role claims for up to one hour. Insufficient privileges after a new role assignment often reflects a stale token or a role assigned at the wrong scope.
- Managed identity token endpoint
- Managed identities obtain tokens from the IMDS endpoint at 169.254.169.254. The identity must be attached to the resource and the endpoint must not be blocked by a firewall.
- Service principal credential errors
- AADSTS7000215 means an invalid client secret and AADSTS700027 means a certificate was not found. Check expiry and thumbprint on the app registration.
- Azure RBAC data-plane gap
- Azure RBAC does not grant data-plane access to storage, Key Vault, or Cosmos DB unless the role is a data-plane role such as Storage Blob Data Contributor, or shared-key authorization is used.
- PIM activation delay
- Eligible role assignments require activation with justification and MFA. The role is not effective until activation completes, which can take several minutes.
- NSG rule evaluation order
- Inbound NSG rules are evaluated by priority, lowest number first, and the first match wins. Default rules apply only after custom rules, and DenyAllInBound is priority 65500.
- UDR next hop None
- A user-defined route with next hop None blackholes matching traffic. Check effective routes on the NIC, because UDRs override system routes and are not visible on the route table alone.
- Load balancer probe source
- Azure Load Balancer health probes originate from 168.63.129.16. NSGs must allow that source, and the backend must answer on the probe port and protocol within the interval.
- Boot diagnostics screenshot use
- The boot diagnostics screenshot and serial log distinguish OS-level boot failures from network-level failures. Check them before changing NSG or firewall rules.
- Run Command dependency
- Run Command and password reset require a healthy VM agent. If the agent is unresponsive, redeploy the VM to a new host before rebuilding the guest operating system.
- JIT VM access verification
- Just-in-time access opens NSG rules temporarily. If RDP still fails after a request, verify the request was approved and the source IP matches the request exactly.