MSAP flashcards
MSAP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Azure RBAC scope inheritance
- Role assignments at a management group or subscription are inherited by all child resource groups and resources. Permissions are additive across assignments, so a user with Reader at subscription and Contributor at a resource group can modify resources in that group.
- Owner vs Contributor role
- Owner has full access including the ability to grant access to others. Contributor can create and manage all resource types but cannot assign roles, so it cannot grant permissions to other principals.
- Azure Policy Deny effect
- The Deny effect blocks creation or update of a resource that violates the policy definition. Existing noncompliant resources are not deleted; they appear as noncompliant and require remediation or manual correction.
- Privileged Identity Management
- A Microsoft Entra ID P2 feature that makes privileged role assignments eligible rather than permanent. Users activate roles just in time with approval, justification, and an expiration window, reducing standing admin access.
- Management group nesting limit
- A tenant can contain up to 10,000 management groups, and any single management group can be nested up to six levels below the tenant root. Each subscription has exactly one parent management group.
- Conditional Access policy
- An Entra ID P1 policy that grants or blocks access based on signals such as user, group, location, device state, and sign-in risk. It requires MFA or compliant device conditions to be satisfied.
- Custom role AssignableScopes
- The list of management groups, subscriptions, or resource groups where a custom role can be assigned. It cannot be the root slash, and the role becomes visible tenant-wide once created.
- Storage account replication options
- LRS keeps three copies in one datacenter, ZRS spreads three copies across zones, GRS adds asynchronous copy to a paired region, and RA-GRS adds read access to the secondary endpoint.
- Blob Archive tier rehydration
- Archive is an offline tier with a 180-day minimum. Reading archived blobs requires rehydration to Hot or Cool, which can take hours and may use standard or high-priority rehydration priority.
- User delegation SAS
- A shared access signature secured by Microsoft Entra credentials instead of the storage account key. It is supported for blobs and is recommended because it can be revoked without rotating account keys.
- Stored access policy
- A policy defined on a container, queue, table, or share that sets start time, expiry, and permissions. Service SAS tokens can reference it, so revoking the policy invalidates the SAS without key rotation.
- Blob lifecycle management rule
- A rule that tiers or deletes block blobs based on days since modification, creation, or last access. Last access time tracking must be enabled before a rule can use it.
- Azure Files identity authentication
- SMB shares support identity-based authentication through AD DS, Microsoft Entra Domain Services, or Microsoft Entra Kerberos for hybrid identities. NFS shares rely on network-level authorization only.
- Blob public access levels
- Private requires authorization, Blob allows anonymous read of blobs only, and Container allows anonymous read and listing of the container. Account-level AllowBlobPublicAccess can disable all public access.
- Premium file share limit
- Premium file shares are provisioned in a FileStorage account and billed on provisioned capacity. They support SMB and NFS, provide higher throughput, and require a minimum provisioned size.
- Availability set fault domains
- A logical grouping of VMs across up to three fault domains and up to twenty update domains within one datacenter. It protects against hardware failure and planned maintenance, with a 99.95% SLA.
- Availability zone SLA
- Physically separate datacenters within one region, each with independent power and networking. Deploying two or more VM instances across zones provides a 99.99% SLA.
- VMSS autoscale rule
- A rule that scales instance count based on a metric threshold, schedule, or both. Scale-out and scale-in rules have cooldowns, and the profile defines minimum, maximum, and default capacity.
- Azure Bastion subnet requirement
- Bastion deploys into a dedicated subnet named AzureBastionSubnet. The subnet must be at least /26 for the Basic and Standard SKUs, or /27 on newer supported SKUs, and cannot host other resources.
- App Service deployment slot
- A live app with its own hostname that can be swapped with production. Swapping warms up the target slot first, and a swap can be rolled back by swapping again or using the previous slot.
- ARM Complete deployment mode
- A deployment mode that deletes resources in the resource group that are not defined in the template. Incremental mode, the default, leaves unlisted resources untouched.
- Burstable VM series
- The B-series accumulates CPU credits while running below its baseline and spends them during bursts. It suits workloads with low average utilization and occasional spikes.
- Azure Functions Consumption plan
- A hosting plan that scales to zero and bills per execution and execution time. It has a default timeout and cold-start latency, and it does not support VNet integration.
- Subnet reserved addresses
- Azure reserves five addresses in every subnet: the network address, the default gateway, two DNS addresses, and the broadcast address. A /24 subnet therefore yields 251 usable addresses.
- NSG rule priority
- Rules are processed from the lowest priority number to the highest, and the first match wins. Default rules have priorities 65000 and above, and custom rules range from 100 to 4096.
- VNet peering transitivity
- Peering connects two VNets with low-latency private traffic but is not transitive. Spoke-to-spoke traffic requires a hub with a firewall or NVA plus user-defined routes and IP forwarding.
- Private endpoint and DNS
- A private endpoint places a private IP for a PaaS service inside a subnet. A linked privatelink private DNS zone resolves the service FQDN to that IP for clients in the VNet.
- Azure Firewall subnet
- Azure Firewall requires a dedicated subnet named AzureFirewallSubnet. It provides stateful filtering, FQDN rules, threat intelligence, and DNAT, and firewall policies can be shared across instances.
- Load Balancer vs Application Gateway
- Azure Load Balancer operates at layer 4 with TCP and UDP and health probes. Application Gateway operates at layer 7 with URL path routing, TLS termination, WAF, and cookie-based affinity.
- Log Analytics diagnostic settings
- Diagnostic settings route resource logs and metrics to a Log Analytics workspace, a storage account, or an event hub. A single resource supports up to five diagnostic settings.
- Azure Monitor alert action group
- A reusable set of notifications and actions such as email, SMS, webhook, Logic App, Automation Runbook, or ITSM. Alert rules reference an action group when their condition fires.
- Azure Backup soft delete
- A vault feature that retains deleted backup data for a configurable period, defaulting to 14 days. It protects backups from accidental or malicious deletion and can be disabled if required.