AZ-900 cheat sheet

Describe cloud concepts

What Is Cloud Computing? An Azure AZ-900 Guide

• Cloud computing is the on-demand delivery of compute, storage, and networking over the internet, paid for on a pay-as-you-go basis.
• The consumption-based model means you pay only for the resources you use, with no large up-front purchase and no charge for idle capacity.
• Cloud shifts spending from a capital expense (CapEx — buying and owning datacenter hardware) to an operating expense (OpEx — paying for a service as you consume it).
• The shared responsibility model divides duties: the provider always secures the physical datacenter and hosts, you always own your data and identities, and the layers between shift with the service type.
• There are three deployment models — public (shared, provider-owned), private (dedicated to one organization), and hybrid (a connected mix of both).
• Use public for low cost and fast scale, private for maximum control and strict compliance, and hybrid to combine the two.
• The trigger phrase "pay only for what you use" maps to the consumption-based model and to an operating expense (OpEx).

Benefits of Cloud Services: An Azure AZ-900 Guide

• High availability keeps applications running with minimal downtime, backed by provider service-level agreements (SLAs).
• Scalability adds or removes resources to meet demand: vertical scaling changes one resource's power (scale up/down), while horizontal scaling changes the number of resources (scale out/in).
• Elasticity is automatic scaling to match demand in real time, whereas scalability is the underlying ability to scale at all.
• Reliability comes from fault tolerance and disaster recovery, letting systems recover from failures and keep functioning.
• Predictability covers both performance (staying consistent as demand changes) and cost (forecasting and tracking your spend).
• The cloud provides a strong, provider-maintained security foundation and governance tools to enforce rules across resources.
• Manageability has two sides: management of the cloud (automation, templates, monitoring) and management in the cloud (portal, command line, and APIs).

IaaS vs PaaS vs SaaS: Cloud Service Types Explained

• The three cloud service types are IaaS, PaaS, and SaaS; moving up the ladder, the provider manages more and you manage less.
• IaaS rents infrastructure and gives you the most control; you manage the operating system and everything above it.
• PaaS provides a managed operating system and runtime; you manage only your application and data.
• SaaS is ready-to-use software; the provider manages almost everything and you just sign in and use it.
• The fastest exam test is 'who manages the operating system?' — you (IaaS) or the provider (PaaS and SaaS).
• Use cases: IaaS for lift and shift, full control, and dev/test; PaaS to build apps without managing infrastructure; SaaS for ready-to-use tools like email and CRM.
• Examples: Azure Virtual Machines is IaaS; Azure App Service and Azure SQL Database are PaaS; Microsoft 365 and Dynamics 365 are SaaS.

Describe Azure architecture and services

Azure Regions, Availability Zones & Resource Hierarchy

• A region is a group of datacenters in one area; regions belong to geographies, and you choose a region when you deploy.
• Region pairs join two regions hundreds of miles apart for disaster recovery and replication; sovereign regions like Azure Government are isolated for compliance.
• Availability zones are physically separate datacenters within a region that protect against a single datacenter failing.
• A resource group is a logical container for related resources, and every resource lives in exactly one group.
• A subscription is a billing and access boundary that holds resource groups.
• Management groups organize multiple subscriptions and pass their settings down to them.
• The logical hierarchy, top to bottom, is management group, subscription, resource group, resource.
• Azure Resource Manager is the deployment and management layer that every management request passes through.

Azure Compute & Networking Services Explained

• Compute options trade control for convenience: virtual machines give the most control, containers add portability, and Azure Functions need the least management.
• Azure Functions is serverless and event-driven, and you pay per execution, so idle code costs almost nothing.
• Azure Container Instances runs a single container quickly; Azure Kubernetes Service orchestrates many containers at scale.
• Virtual Machine Scale Sets run identical VMs that autoscale with demand; availability sets spread VMs across hardware for reliability.
• Azure App Service is a platform-as-a-service option for hosting web apps and APIs without managing servers.
• An Azure Virtual Network (VNet) is your private network in Azure; subnets divide it and peering connects VNets together.
• VPN Gateway connects your network to Azure with encryption over the public internet; ExpressRoute uses a private, dedicated connection that does not use the internet.

Azure Storage Services, Tiers & Redundancy: AZ-900

• Azure Blob Storage is object storage for unstructured data (images, video, backups); Azure Files is managed SMB/NFS file shares; Queue Storage is messaging; Table Storage is NoSQL key-value; Disk Storage provides virtual machine disks.
• Blob access tiers trade storage cost against access cost: hot (frequent), cool (infrequent), cold (rare), and archive (rarely accessed, cheapest to store, with an hours-long retrieval latency).
• The archive tier is the cheapest and best for rarely accessed, long-term data you can wait to retrieve.
• Redundancy keeps multiple copies: LRS (one datacenter), ZRS (across availability zones in one region), GRS (paired secondary region), and GZRS (zones plus a secondary region).
• To protect data against a full regional outage, choose a geo-redundant option — GRS or GZRS; LRS and ZRS stay within a single region.
• A storage account is the top-level container for your data, where you set region, redundancy, and performance; standard uses magnetic drives while premium uses SSDs for speed.
• Move files with AzCopy (command line), Azure Storage Explorer (GUI), and Azure File Sync (sync a local server), and migrate large data sets with Azure Migrate and the physical Azure Data Box appliance.

Azure Identity, Access & Security: AZ-900 Guide

• Microsoft Entra ID is Azure's cloud identity and directory service — formerly named Azure Active Directory (Azure AD) — that stores accounts and verifies sign-ins; Microsoft Entra Domain Services adds managed, traditional domain features like domain join and Kerberos.
• Authentication methods include single sign-on (sign in once for many apps), multi-factor authentication (two or more factors for strong protection), and passwordless (replacing the password with the Authenticator app, Windows Hello, or a security key).
• Conditional Access grants or blocks access based on signals such as location, device, application, and sign-in risk — for example, requiring MFA for administrators.
• Azure role-based access control (RBAC) assigns roles (who + what + scope) to grant least-privilege permissions, so users get only the access their job needs.
• Zero Trust means "never trust, always verify" — verify every request explicitly, use least privilege, and assume breach.
• Defense in depth layers multiple independent security controls (the onion model) so that if one layer fails, another still protects the data at the center.
• Microsoft Defender for Cloud improves security posture with a secure score and recommendations and protects workloads with threat detection and alerts.

Describe Azure management and governance

Azure Cost Management: Estimate, Monitor, and Reduce Cloud Spend

• Azure costs depend on resource type, usage, region, network egress, and subscription or billing type.
• Use the Pricing Calculator to estimate the cost of Azure services before you deploy them.
• Use the TCO Calculator to compare running workloads on-premises versus in Azure.
• Microsoft Cost Management monitors, analyzes, and controls actual spend with cost analysis, budgets, and alerts.
• Azure Reservations discount resources for a 1-year or 3-year commitment; savings plans commit to hourly compute spend.
• Spot VMs give deep discounts on spare capacity but can be evicted; Azure Hybrid Benefit reuses existing licenses.
• Tags are metadata labels that help you organize, allocate, and report Azure costs by team, project, or environment.

Azure Governance and Compliance: Purview, Policy, and Resource Locks

• Microsoft Purview provides unified data governance and compliance through data cataloging, classification, and discovery across your estate.
• Azure Policy enforces organizational rules on resources, using effects like audit (flag) and deny (block non-compliant resources).
• The classic Azure Policy example is allowing only certain regions or requiring a tag on every resource.
• RBAC controls who can perform actions; Azure Policy controls what configurations are allowed, and both often apply together.
• Resource locks prevent accidental deletion or modification: CanNotDelete blocks deletion, while ReadOnly blocks both modification and deletion.
• Locks apply to everyone regardless of RBAC role and must be removed before the blocked action can proceed.
• Azure Blueprints package policies, role assignments, and resources into a repeatable definition for consistent, governed environments.

Azure Management and Deployment Tools: Portal, CLI, PowerShell, Arc and IaC

• The Azure portal is the web-based graphical interface (GUI) for managing Azure and building dashboards; best for learning and one-off changes.
• Azure Cloud Shell is a browser-based shell, already authenticated, that comes preloaded with the Azure CLI and Azure PowerShell.
• Azure CLI uses az commands and Azure PowerShell uses Verb-Noun cmdlets; both are cross-platform scripting tools that do the same job in different styles.
• Choose the GUI (portal) for occasional, visual work and a scripting tool (CLI or PowerShell) when you need to automate and repeat.
• Azure Arc extends Azure management to resources outside Azure, on-premises servers, other clouds, and Kubernetes, as a single control plane.
• Infrastructure as code defines resources in files for declarative, repeatable deployments.
• ARM templates are JSON and Bicep is the simpler language that compiles to ARM JSON; both deploy through Azure Resource Manager.

Azure Monitoring Tools: Advisor, Service Health and Azure Monitor

• Azure Advisor gives personalized recommendations across five categories: cost, security, reliability, operational excellence, and performance.
• Azure Service Health tells you whether an Azure service issue, planned maintenance, or health advisory is affecting your specific resources, unlike the generic public Azure status page.
• Azure Monitor is the full-stack platform for collecting and analyzing metrics and logs from your applications and infrastructure.
• Log Analytics is the part of Azure Monitor where you query and analyze logs using Kusto Query Language (KQL).
• Azure Monitor alerts notify you or trigger an action when a condition you define is met.
• Application Insights is Azure Monitor's application performance monitoring (APM) feature for tracking a web app's response times, failures, and usage.
• Match the question to the tool: improve resources means Advisor, is Azure affecting me means Service Health, and how are my apps behaving means Azure Monitor.