Azure AZ-720 key terms

A disaster recovery service that replicates virtual machines and physical servers to a secondary Azure region or on-premises site, enabling orchestrated failover and failback with recovery plans and test failovers.

The maximum acceptable amount of data loss measured in time, representing how far back the last recoverable copy of data may be. It guides replication frequency and backup schedule design.

The maximum acceptable duration of downtime before a service must be restored. It drives failover automation, recovery plan design, and decisions about hot, warm, or cold standby architectures.

A cloud backup service that protects virtual machines, files, databases, and workloads using recovery services vaults, backup policies, and restore points. It supports application-consistent snapshots and long-term retention.

A management container in Azure that stores backup data and replication configuration for Azure Backup and Azure Site Recovery. Vault configuration, redundancy, and soft-delete settings affect recoverability.

A data protection feature that retains deleted backup items or vaults for a configurable retention period, allowing recovery from accidental or malicious deletion. It must be enabled and understood during restore troubleshooting.

A physically separate datacenter group within an Azure region, with independent power, cooling, and networking. Deploying across zones protects workloads from single-datacenter failures and influences replication and failover design.

A logical grouping of virtual machines that reduces correlated failures by distributing them across fault domains and update domains within a datacenter. It does not protect against datacenter-level outages.

A group of hardware in a datacenter that shares a single point of failure, such as a power source or network switch. Virtual machines in an availability set are spread across fault domains to avoid simultaneous failure.

A logical group of virtual machines in an availability set that can undergo planned maintenance or reboots together. Distributing machines across update domains prevents all instances from restarting simultaneously.

A predefined pairing of two Azure regions within the same geography used for platform-level replication and prioritized recovery. Paired regions support services such as geo-redundant storage and some disaster recovery designs.

A DNS-based global traffic distribution service that routes clients to endpoints based on priority, weighted, performance, geographic, or multivalue routing methods. It supports endpoint health probes and fast failover.

A layer-4 load balancing service that distributes TCP and UDP traffic among backend pool members using health probes and rules. It supports public and internal configurations and is often used for regional high availability.

A periodic check sent by a load balancer or traffic manager to a backend endpoint to determine availability. Failed probes remove endpoints from rotation, so probe configuration and network access must be validated.

The collection of resources, such as virtual machines or IP addresses, that receive traffic from a load balancer. Membership and network security group rules determine whether traffic reaches those resources.

A private connectivity service that connects on-premises networks to Azure through a connectivity provider, bypassing the public internet. Circuit provisioning, peering configuration, and route advertisement are common troubleshooting areas.

The logical connection between an on-premises network and Microsoft's cloud edge through a provider. It includes service key, peering, bandwidth, and status details that must be verified when private connectivity fails.

The routing protocol session used to exchange network prefixes between on-premises routers and Azure gateways or ExpressRoute. State, ASN, and advertised route issues often explain hybrid connectivity failures.

A virtual network gateway that sends encrypted traffic between Azure and on-premises networks or other virtual networks over the public internet. Gateway SKU, IPsec policy, and shared key mismatches are frequent causes of failure.

A VPN connection that links an entire on-premises network to an Azure virtual network through IPsec/IKE tunnels. Troubleshooting involves gateway status, local network gateway address spaces, and compatible encryption settings.

A VPN connection from an individual client device to an Azure virtual network, typically using certificate or Microsoft Entra authentication. Client configuration, address pool, and authentication settings are common failure points.

A set of security rules that allow or deny inbound and outbound traffic to Azure resources based on source, destination, port, and protocol. Rule priority and subnet versus NIC association affect effective access.

The combined NSG rules that actually apply to a network interface, after merging subnet-level and NIC-level rules and resolving priority order. Inspecting them is a primary step when traffic is unexpectedly blocked.

A logical grouping of network interfaces used in NSG rules to simplify security policy for workloads. It lets rules reference application roles instead of explicit IP addresses, reducing configuration errors.

A managed, stateful network security service that provides centralized filtering, threat intelligence, and logging for Azure workloads. Rule collections, DNS proxy settings, and forced tunneling affect connectivity.

A custom route table entry that overrides Azure system routes to direct traffic to a virtual appliance, gateway, or the internet. Misconfigured next-hop addresses or missing routes commonly break connectivity.

An Azure resource containing routes that determine where traffic from subnets is forwarded. Effective routes combine system, user-defined, and BGP routes, and must be inspected when traffic takes an unexpected path.

A direct, low-latency connection between two Azure virtual networks that allows private IP traffic. Peering state, address space overlap, and gateway transit settings are frequent troubleshooting subjects.

A regional Azure service providing network diagnostic tools such as topology, connection troubleshoot, IP flow verify, next hop, and packet capture. It is central to isolating connectivity failures at the network layer.

A Network Watcher diagnostic that checks whether a packet is allowed or denied to or from a virtual machine and identifies the security rule responsible. It helps distinguish NSG blocks from routing or host issues.

A Network Watcher feature that tests connectivity from a virtual machine to a destination endpoint and reports latency and failure points. It helps validate reachability before deeper packet-level analysis.

A private IP address in a virtual network that connects to an Azure PaaS service through Azure Private Link. DNS resolution, subnet configuration, and private DNS zone links are common troubleshooting areas.

A technology that provides private connectivity to Azure services and customer-owned services over a private IP address. It eliminates public internet exposure but requires correct DNS and approval workflows.

A feature that extends the virtual network identity to Azure PaaS services over the Azure backbone. It restricts service access to specified subnets but does not provide a private IP address for the service.

A DNS zone hosted in Azure that resolves names only within linked virtual networks. Correct zone links and records are required for private endpoints and internal name resolution to work.

A platform-as-a-service offering for hosting web apps, APIs, and mobile backends. Troubleshooting covers app settings, deployment slots, scaling, health checks, and platform-level diagnostics.

The compute resource that defines the region, pricing tier, instance size, and scale count for App Service apps. Capacity, quota, and scale operation failures are common PaaS troubleshooting topics.

A live app instance within an App Service that can receive deployments and be swapped into production. Slot-specific settings and swap behavior often explain configuration or connectivity differences between environments.

The deployment and diagnostics engine behind App Service, offering logs, process explorer, and a console. It is used to inspect application startup, file system issues, and environment variables during PaaS troubleshooting.

An automatically managed identity in Microsoft Entra ID that Azure resources use to authenticate to other services without storing credentials. Missing role assignments or audience mismatches often cause access failures.

A security identity used by applications, services, or automation to access Azure resources. Credential expiration, permission scope, and consent issues are common causes of authentication failures.

An authorization system that grants access by assigning roles to security principals at a scope. Effective permissions combine inherited assignments, deny assignments, and role definitions, which must be reviewed when access is denied.

A Microsoft Entra policy engine that enforces sign-in controls based on user, device, location, and risk signals. Misconfigured policies can block legitimate access and are investigated through sign-in logs.

An authentication method requiring two or more verification factors. Failures can stem from misconfigured policies, unreachable verification methods, or legacy authentication protocols that do not support MFA.

Microsoft's cloud identity and access management service, formerly Azure Active Directory. It provides authentication, authorization, and directory services, and its logs are essential for access troubleshooting.

Records in Microsoft Entra ID that capture authentication attempts, including status, conditional access results, and failure reasons. They are a primary source for diagnosing user and application sign-in problems.

A VM feature that captures serial console output and screenshots to diagnose startup failures. It helps distinguish operating system boot problems from networking or platform issues.

An Azure feature that provides text-based console access to a virtual machine's serial port without network connectivity. It is used to recover misconfigured firewalls, network settings, or boot problems.

An Azure VM feature that executes scripts inside the guest operating system through the VM agent. It enables troubleshooting and remediation without requiring inbound network access.

A lightweight process installed in Azure virtual machines that enables extensions, Run Command, and other platform interactions. Its health and version are prerequisites for many management and diagnostic features.

A Microsoft Defender for Cloud capability that opens management ports only on request for a limited time and source IP. It reduces exposure but can cause connection failures when requests are not approved or expire.

A managed jump-host service that provides secure RDP and SSH access to virtual machines through the Azure portal over TLS. It removes the need for public IP addresses on VMs and avoids direct management port exposure.