Azure AZ-900 cheat sheet

Cloud computing delivers compute, storage, networking, and applications over the internet with pay-as-you-go pricing; the customer does not own the physical infrastructure.

The shared responsibility model splits duties: the provider secures the physical datacenter, hosts, and network; the customer secures data, identities, devices, and, depending on service model, the OS and applications.

IaaS gives the customer control of the OS and runtime; PaaS gives control of applications and data; SaaS gives control only of data and access.

Consumption-based pricing charges only for usage; it shifts spend from capital expenditure (CapEx) to operating expenditure (OpEx).

Vertical scaling (scale up/down) changes the size or power of one instance; horizontal scaling (scale out/in) changes the number of instances.

Elasticity automatically adds or removes resources to match demand; scalability is the capacity to handle growth.

Public cloud is provider-owned and multi-tenant; private cloud is dedicated to one organization; hybrid cloud connects both.

High availability minimizes downtime with redundancy; disaster recovery restores service after a major failure and is measured by RTO and RPO.

Serverless computing abstracts servers, scales automatically, and bills per execution; it suits event-driven workloads.

Azure regions are geographic areas containing datacenters; region pairs provide disaster recovery and are updated sequentially.

Availability zones are physically separate datacenter groups within a region; they isolate failures from power, cooling, or network issues.

The resource hierarchy is tenant > management groups > subscriptions > resource groups > resources.

A resource belongs to exactly one resource group; a resource group can contain resources from different regions; deleting the group deletes its resources.

A subscription is a billing and access boundary; management groups organize multiple subscriptions for governance.

Compute options: Virtual Machines (IaaS), VM Scale Sets (identical VMs), App Service (PaaS web apps), Azure Functions (serverless), and AKS (containers).

Storage services: Blob for unstructured objects, Files for SMB/NFS shares, Queue for messages, Table for NoSQL key-value data, and Disk for VM disks.

Networking: VNets provide isolation and subnets; NSGs filter traffic; Load Balancer is layer 4; Application Gateway is layer 7; ExpressRoute is a private connection.

Microsoft Entra ID provides identity and access management with SSO, MFA, and Conditional Access; managed identities give Azure resources identities.

Azure Policy enforces rules and audits compliance; initiatives group multiple policies; policy can deny, audit, or remediate resources.

RBAC grants roles to identities at a scope (management group, subscription, resource group, or resource); assignments are inherited downward.

Resource locks: CanNotDelete prevents deletion; ReadOnly prevents changes; locks apply regardless of RBAC role.

Cost tools: Pricing Calculator estimates new workloads; TCO Calculator compares on-premises vs Azure; Cost Management analyzes and budgets actual spend.

Tags are key-value metadata used for cost allocation and organization; tags are not inherited by default.

Azure Monitor collects metrics and logs and creates alerts; Application Insights monitors application performance; Log Analytics stores queryable logs.

Azure Service Health reports personalized service issues, planned maintenance, and health advisories; Azure Advisor gives best-practice recommendations.

Microsoft Defender for Cloud provides security posture management, secure score, and threat protection; Microsoft Purview provides data governance and cataloging.

Infrastructure as code: ARM templates are JSON deployments; Bicep is a declarative language that transpiles to ARM JSON.