AZ 900 MS Learn

for a VPN gateway you need to deploy a subnet called

"GatewaySubnet" for the VPN gateway. Use at least a /27 address mask to make sure you have enough IP addresses in the subnet for future growth. You can't use this subnet for any other services.

To connect your datacenter to a VPN gateway, you'll need these on-premises resources:

- A VPN device that supports policy-based or route-based VPN gateways - A public-facing (internet-routable) IPv4 address

With Azure Firewall, you can configure:

- Application rules that define fully qualified domain names (FQDNs) that can be accessed from a subnet. - Network rules that define source address, protocol, destination port, and destination address. - Network Address Translation (NAT) rules that define destination IP addresses and ports to translate inbound requests.

Azure AD provides services such as:

- Authentication: verifying identity to access apps and resources, providing self-service password reset, multi-factor authentication (MFA), a custom banned password list, and smart lockout services. - Single-Sign-On (SSO): A single identity is tied to a user, simplifying the security model. As users change roles or leave an organization, access modifications are tied to that identity, greatly reducing the effort needed to change or disable accounts. - Application management: manage your cloud and on-premises apps using Azure AD Application Proxy, SSO, the My apps portal (also referred to as Access panel), and SaaS apps. - Device Management: Manage how your cloud or on-premises devices access your corporate data.

What services provide provide Azure AD Multi-Factor Authentication capabilities

- Azure Active Directory: free edition has MFA for global admins; premium allows MFA via Conditional Access - Office 365: subset of Azure AD MFA is part of your Office 365 subscription

Azure has two implementations of serverless compute:

- Azure Functions: Functions can execute code in almost any modern language. - Azure Logic Apps: Logic apps are designed in a web-based designer and can execute logic triggered by Azure services without writing any code.

Azure Firewall provides many features, including:

- Azure Monitor logging. - Built-in high availability. - Unrestricted cloud scalability. - Inbound and outbound filtering rules. - Inbound Destination Network Address Translation (DNAT) support.

Azure supports a broad range of technologies and services to provide big data and analytic solutions, including

- Azure Synapse Analytics - Azure HDInsight - Azure Databricks - Azure Data Lake Analytics

Azure Database for PostgreSQL Single Server

- Built-in high availability (99.99 percent SLA) for no additional cost - Predictable performance and inclusive, pay-as-you-go pricing. - Vertical scale as needed, within seconds. - Monitoring and alerting to assess your server. - Enterprise-grade security and compliance. - Ability to protect sensitive data at-rest and in-motion. - Automatic backups and point-in-time-restore for up to 35 days. No extra cost or admin stuff

Azure Database for PostgreSQL delivers the following benefits:

- Built-in high availability (v. on-premises) for no additional cost - Simple and flexible pricing. You have predictable performance based on a selected pricing tier choice that includes software patching, automatic backups, monitoring, and security. - Scale up or down as needed, within seconds. You can scale compute or storage independently as needed, to make sure you adapt your service to match usage. - Adjustable automatic backups and point-in-time-restore for up to 35 days. - Enterprise-grade security and compliance to protect sensitive data at-rest and in-motion. This security covers data encryption on disk and SSL encryption between client and server communication.

Azure Database for MySQL delivers:

- Built-in high availability with no additional cost. - Predictable performance and inclusive, pay-as-you-go pricing. - Scale as needed, within seconds. - Ability to protect sensitive data at-rest and in-motion. - Automatic backups. - Enterprise-grade security and compliance.

The benefits of using Key Vault include:

- Centralized application secrets: so you can control distribution, and reduces chances that secrets are accidentally leaked. - Securely stored secrets and keys: industry-standard algorithms, key lengths, and HSMs. - Access monitoring and access control: monitor and control access to secrets. - Simplified administration of application secrets: esay to enroll and renew certificates from public certificate authorities (CAs). - Integration with other Azure services: integrate with storage accounts, container registries, event hubs, ++. to securely reference the secrets stored in Key Vault.

ExpressRoute supports three models that you can use to connect your on-premises network to the Microsoft cloud:

- CloudExchange colocation - Point-to-point Ethernet connection - Any-to-any connection

Azure Sentinel enables you to:

- Collect cloud data at scale (across users, devices, apps, and infrastructure) both on-premises and from multiple clouds. - Detect previously undetected threats (+ Minimize false positives by using Microsoft's comprehensive analytics and threat intelligence.) - Investigate threats with AI - Respond to incidents rapidly with built-in orchestration and automation of common tasks

With Azure Machine Learning, you can:

- Create a process defining how to get data, handle missing/bad data, split data into a training set or test set, and deliver the data to the training process. - Train and evaluate predictive models by using tools and programming languages familiar to data scientists. - Create pipelines that define where and when to run the compute-intensive experiments that are required to score the algorithms based on the training and test data. - Deploy the best-performing algorithm as an API to an endpoint so it can be consumed in real time by other applications.

There are three main ways to purchase services on Azure. They are:

- Enterprise Agreement: larger customers agree to spend a predetermined amount over 3 years - paid annually - From the web: purchase services in Azure Portal - billed monthly with credit cards or invoices - Via a Cloud Solution Provider: Your CSP bills you for Azure as they determine and answer support questions

Azure Government services handle data that is subject to certain government regulations and requirements such as

- Federal Risk and Authorization Management Program (FedRAMP) - National Institute of Standards and Technology (NIST) 800.171 Defense Industrial Base (DIB) - International Traffic in Arms Regulations (ITAR) - Internal Revenue Service (IRS) 1075 - Department of Defense (DoD) L4 - Criminal Justice Information Service (CJIS)

Azure free account provides

- Free access to popular Azure products for 12 months. - A credit to spend for the first 30 days. - Access to more than 25 products that are always free.

benefits of Azure Dedicated Host

- Gives visibility and control of the server infrastructure that's running your Azure VMs. - Helps address compliance requirements by deploying your workloads on an isolated server. - Lets you choose the number of processors, server capabilities, VM series, and VM sizes within the same host.

Who uses Azure AD?

- IT admins: to controll access to app and resources - developers: to add single sign on functional to n app etc - users: to change their password w/o IT support - online service subscribers: Microsoft 365, office, azure, etc. all have Azure AD tenants

Microsoft's Trust Center provides:

- In-depth information about security, privacy, compliance offerings, policies, features, and practices across Microsoft cloud products. - Additional resources for each topic. - Links to the security, privacy, and compliance blogs and upcoming events.

Azure virtual networks provide the following key networking capabilities:

- Isolation and segmentation between multiple VNets - Internet communications - Communicate between Azure resources - Communicate with on-premises resources - Route/filter network traffic across subnets and networks - Connect virtual networks - set up secure endpoints + protect again sql injects and cross site scripting - allows private IPs

Azure Cognitive Services categories

- Language services: to process natural language with prebuilt scripts, evaluate sentiment, and learn how to recognize what users want. - Speech services: Convert speech into text and text into natural-sounding speech. Translate from one language to another and enable speaker verification and recognition. - Vision services: Add recognition and identification capabilities when you're analyzing pictures, videos, and other visual content. - Decision services: Add personalized recommendations for each user that automatically improve each time they're used, moderate content to monitor and remove offensive or risky content, and detect abnormalities in your time series data.

Pros to using ExpressRoute

- Layer 3 (address level) connectivity between your on-premises network and the Microsoft Cloud through a connectivity provider. - Connectivity to Microsoft cloud services across all regions in the geopolitical region. - Global connectivity to Microsoft services across all regions with the ExpressRoute premium add-on. - Dynamic routing between your network and Microsoft via BGP. - Built-in redundancy in every peering location for higher reliability. - Connection uptime SLA. - QoS support for Skype for Business.

How can you limit network connectivity across all of your resources to allow only what's required (network layer)?

- Limit communication between resources by segmenting your network and configuring access controls - deny by default - Restrict inbound internet access and limit outbound where appropriate - Implement secure connectivity to on-premises networks

Benefits of Azure Resource Manager

- Manage infrastructure w/ templates rather than scripts: a JSON file that defines what you want to deploy to Azure. - Deploy, manage, and monitor all the resources for your solution as a group, rather than handling these resources individually. - Redeploy your solution throughout the development life cycle and have confidence your resources are deployed in a consistent state. - Define the dependencies between resources so they're deployed in the correct order. - Apply access control to all services because RBAC is natively integrated into the management platform. - Apply tags to resources to logically organize all the resources in your subscription. - Clarify your organization's billing by viewing costs for a group of resources that share the same tag.

Azure Key Vault can help you:

- Manage secrets: store and tightly control access to tokens, passwords, certificates, API keys, and other secrets. - Manage encryption keys: create and control the encryption keys that are used to encrypt your data. - Manage SSL/TLS certificates: provision, manage, and deploy your public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for both your Azure resources and your internal resources. - Store secrets backed by hardware security modules (HSMs): secrets and keys can be protected by software or by FIPS 140-2 Level 2 validated HSMs.

xpressRoute enables direct access to the following services in all regions:

- Microsoft Office 365 - Microsoft Dynamics 365 - Azure compute services, such as Azure Virtual Machines - Azure cloud services, such as Azure Cosmos DB and Azure Storage

Azure Security Center can

- Monitor security settings across on-premises and cloud workloads. - Automatically apply required security settings to new resources as they come online. - Provide security recommendations based on your current configurations, resources, and networks. - Continuously monitor your resources and perform security assessments to identify potential vulnerabilities - Use machine learning to detect and block malware from being installed on your virtual machines (VMs) and other resources. You can also use adaptive application controls to define rules that list allowed applications to ensure that only applications you allow can run. - Detect and analyze potential inbound attacks and investigate threats and any post-breach activity that might have occurred. - Provide just-in-time access control for network ports to reduces your attack surface by ensuring that the network only allows traffic you require at the time that you need it to.

Azure virtual networks enable you to filter traffic between subnets by using

- Network security groups - Network virtual appliances

Advantages of IaaS

- No CapEx - Agility. Applications can be made accessible quickly, and deprovisioned whenever needed. - Management. The shared responsibility model applies; the user manages and maintains the services they have provisioned, and the cloud provider manages and maintains the cloud infrastructure. - Consumption-based model. Organizations pay only for what they use and operate under an Operational Expenditure (OpEx) model. - Skills. No deep technical skills are required to deploy, use, and gain the benefits of a public cloud. Organizations can use the skills and expertise of the cloud provider to ensure workloads are secure, safe, and highly available. - Cloud benefits. Organizations can use the skills and expertise of the cloud provider to ensure workloads are made secure and highly available. - Flexibility. IaaS is the most flexible cloud service because you have control to configure and manage the hardware running your application.

Advantages of PaaS

- No CapEx - Agility. PaaS is more agile than IaaS, and users don't need to configure servers for running applications. - Consumption-based model. Users pay only for what they use, and operate under an OpEx model. - Skills. No deep technical skills are required to deploy, use, and gain the benefits of PaaS. - Cloud benefits. Users can take advantage of the skills and expertise of the cloud provider to ensure that their workloads are made secure and highly available. In addition, users can gain access to more cutting-edge development tools. They can then apply these tools across an application's lifecycle. - Productivity. Users can focus on application development only, because the cloud provider handles all platform management. Working with distributed teams as services is easier because the platform is accessed over the internet. You can make the platform available globally more easily.

Advantages of SaaS

- No CapEx - Agility. Users can provide staff with access to the latest software quickly and easily. -Pay-as-you-go pricing model. Users pay for the software they use on a subscription model, typically monthly or yearly, regardless of how much they use the software. - Skills. No deep technical skills are required to deploy, use, and gain the benefits of SaaS. - Flexibility. Users can access the same application data from anywhere.

A consumption-based model has many benefits, including:

- No upfront costs. - No need to purchase and manage costly infrastructure that users might not use to its fullest. - The ability to pay for additional resources when they are needed. - The ability to stop paying for resources that are no longer needed.

Azure virtual networks enable you to link resources together to create a network that spans both your local and cloud environments How can you do this?

- Point-to-site virtual private networks - Site-to-site virtual private networks - Azure ExpressRoute

Azure Advisor Recommendation types

- Reliability: to ensure and improve the continuity of your business-critical applications. - Security: to detect threats and vulnerabilities that might lead to security breaches. - Performance: to improve the speed of your applications. - Cost: to optimize and reduce your overall Azure spending. - Operational Excellence: to help achieve process and workflow efficiency, resource manageability, and deployment best practices.

Security Score helps you

- Report on the current state of your organization's security posture. - Improve your security posture by providing discoverability, visibility, guidance, and control. - Compare with benchmarks and establish key performance indicators (KPIs).

Azure Cost Management + Billing features include:

- Reporting: Use historical data to generate reports and forecast future expenditure. - Data enrichment: categorize resources with tags that correspond to real-world business and organizational units. - Budgets: Create and manage cost and usage budgets by monitoring resource demand trends, consumption rates, and cost patterns. - Alerting: Get alerts based on your cost and usage budgets. - Recommendations: Receive recommendations to eliminate idle resources and to optimize the Azure resources you provision.

What is tag metadata useful for?

- Resource management: you can locate and act on resources associated with specific workloads, environments, business units, and owners. - Cost management and optimization: you can group resources so you can report on costs, allocate internal cost centers, track budgets, and forecast estimated cost. - Operations management: you can group resources according to how critical their availability is to your business. This grouping helps you formulate service-level agreements (SLAs). - Security: you can classify data by its security level (e.g. public/confidential) - Governance and regulatory compliance: you can identify resources that align with governance or regulatory compliance requirements, or your own requirements like owner and department name - Workload optimization and automation: you can visualize resources that participate in complex deployments. e.g. tag a resource with its app name and use DevOps to perform automated tasks on those resources.

Azure Blueprints orchestrates the deployment of various resource templates and other artifacts, such as:

- Role assignments - Policy assignments - Azure Resource Manager templates - Resource groups

Service Health helps you keep an eye on several event types:

- Service issues: problems in Azure (e.g. outages) that affect you right now. - Planned maintenance: You can see how an event will affect you and what you need to do. Most occur without any impact to you and aren't shown here. If a reboot is required, Service Health allows you to choose when to perform the maintenance to minimize the downtime. - Health advisories: issues that require you to act to avoid service interruption, including service retirements and breaking changes. Health advisories are announced far in advance to allow you to plan.

Blob Storage is ideal for:

- Serving images or documents directly to a browser. - Storing files for distributed access. - Streaming video and audio. - Storing data for backup and restore, disaster recovery, and archiving. - Storing data for analysis by an on-premises or Azure-hosted service. - Storing up to 8 TB of data for virtual machines.

Key features of route-based VPN gateways in Azure include:

- Supports IKEv2 - Uses any-to-any (wildcard) traffic selectors - Can use dynamic routing protocols, where routing/forwarding tables direct traffic to different IPSec tunnels. Data packets are encrypted based on network routing tables that are created dynamically using routing protocols such as Border Gateway Protocol (BGP).

VMs are an ideal choice when you need:

- Total control over the operating system (OS). - The ability to run custom software. - To use custom hosting configurations.

You'll want to enable Azure resources to communicate securely with each other. You can do that in one of two ways:

- Virtual networks to connect to VMs/App Services & other Azure resources - Service endpoints to connect to other Azure resource types, such as Azure SQL databases and storage accounts. This approach enables you to link multiple Azure resources to virtual networks to improve security and provide optimal routing between resources.

What kinds of attacks can DDoS Protection Standard tier help prevent?

- Volumetric attacks: flood network layer with a substantial amount of seemingly legitimate traffic. - Protocol attacks: render a target inaccessible by exploiting a weakness in the layer 3 and layer 4 protocol stack. - Resource-layer (application-layer) attacks (only with web application firewall): target web app packets to disrupt the transmission of data between hosts (layer 7)

With App Service, you can host most common app service styles like:

- Web apps; ASP.NET Core, Java, Ruby, PHP, Python etc - API apps; REST based web apis w/ swagger - WebJobs; run programs or scripts often by trigger - Mobile apps; quickly build backend stuff and support for front-end

DDoS Protection service tiers

- basic; automatically enabled/free, traffic monitoring and mitigation of network-level attacks ensuring Azure infrastructure is not affected, Azure global network distributes and mitigates attack traffic across Azure regions - standard: extra capabilities for Virtual Network resources, protection is tuned via dedicated traffic monitoring and machine learning algorithms. policies are applied to resources in virtual networks like Azure Load Balancer and Application Gateway

Why should you use Azure virtual desktop?

- best user experience: use any device; have VMs near apps and services for faster loading; login is fast - enhance security; MFA and role-based access controls can be used; separated from hardware protecting confidential info; reverse connect technology doesn't use inbound ports = more secure

There are three main aspects to consider when you create and manage subscriptions:

- billing (maybe break up with subscriptions) - access control (maybe use subscriptions and RBAC) - subscription limit (spread resources across subscriptions if you hit limits)

How to start with machine learning

- collect your data and analyze it to check for biases, accuracy, and validity - split the data into training data and evaluation data - choose a model for you data (text-based, visual, other data) - train model on training data and let it create an algorithm - use evaluation data to test the model for accuracy - tweak algorithm manually if needed & retest - deploy

STAR Certification demonstrates that the CSP (Cloud service provider):

- conforms to application requirements of ISO/IEC 27001 - Has addressed issues critical to cloud security as outlined in the CCM - Has been assessed against the STAR Combability Maturity Model for the mgmt of activities in CCM control areas

To build a SLA for your app you should

- determine workload (what resource you must use to create your app) - combine SLAs to computer the composite SLA of those resources - consider customization options to meet your SLA goal e.g. different tiers, backup storages, deploy 2+ in diff availability zones, duplicate components (redundancy)

migration process flow

- discover: the features you use/need - assess: which on-prem dbs can be migrated - migrate: move data - cutover: change connection strings - optimize: optimize

When to use VMs

- during testing and development - when running apps in the cloud - when extending you datacenter to the cloud - during disaster recovery

How does the TCO Calculator work?

- enter details of your on prem workloads - review suggested industry average cost (adjust if needed) for OpEx (include electricity, network maintenance, IT labor) - review the side by side report to compare on premise cost breakdown with Azure cost breakdown

key features of Azure Virtual Desktop

- familiar to Azure admins bc uses Azure AD, RBAC (role based access controls), Azure Monitor etc - load balancing uses on VM host pools (collections of VMs with the same configuration assigned to multiple users) - Windows 10 Enterprise multi-session can be used to allow multiple concurrent users on a single VM

Types of Azure subscriptions

- free trial: 12 months of popular free services, a credit to explore any Azure service for 30 days, and more than 25 services that are always free - pay-as-you-go: pay for what you use - member offers: certain Microsoft products may come with Azure credits or reduced rates in Azure (e.g. Visual Studio subscribers)

What four compliance categories does Azure support?

- global (e.g. ISO stuff) - US Gov (e.g. DoD stuff; CJIS) - Industry (e.g. PCI DSS- Payment Card Industry Data Security Standard) - Regional (e.g. Canada Privacy Laws)

What are three ways to organize related resources?

- group them by subscription - group them by resource group - group them using tags

Three Azure storage tiers

- hot; frequently accessed data - cool; infrequently access and stored for at least 30 days - archive; rarely accessed data and stored for at least 180 days

What's in a typical SLA

- intro: explains expectations like its scope, and how subscription renewals can affect terms - general terms: defining words like downtime, and how to submit claims and get credits - SLA details: guarantees of the service as a %, focuses on uptime and may address latency (speed), what happens if Azure fails to meet specifications -- typically a credit

Organize the four levels of Azure's management structure in a top-down hierarchy or organization - subscriptions - resources - resource groups - management groups.

- management groups - subscriptions - resource groups - resources

When to use Azure Files

- migrate on prem file shares to cloud with few changes needed in app - store config and other developer files files to access from multiple VMs - write data to a file share and processing/analyze it later -- diagnostic logs, metrics, or crash dumps

Configurable settings for basic virtual network

- network name (unique to subscription) - address space in CIDR (unique to subscription and any other networks you connect to) - subscription and location of vNet - subnet to partition vNet - DDoS protection: basic or standard - Service endpoints: select endpoints you want to enable including Azure Cosmos DB, Service Bus, Key Vault, etc

3 big benefits of serverless computing

- no infrastructure management - automatic scalability - only pay for what you use

If you explore the azure compliance document for a specific standards page you will see

- overview of standard - cloud services in scope - overview of audit cycle and links to audit reports - answers to FAQs - additional resources

options that you can configure in the Pricing calculator can include

- region - tier - billing options (like enterprise exceptions) - support options - programs and offers (like licensing stuff) - Azure Dev/Test pricing (for Dev/Test stuff)

Azure VPN Gateway instances are deployed in Azure Virtual Network instances and enable the following connectivity

- site-to-site - point-to-site - network-to-network

Three categories of sign ons for MFA

- something the user knows: email addr and password - something the user has: code on a phone - something the user is: biometric property like fingerprint

Azure resources you need to deploy an operational VPN gateway

- virtual network - gateway subnet - public ip addr - local network gateway - virtual network gateway - connection

advantages of region pairs:

- you can use them to provide reliable services and data redundancy - If an extensive Azure outage occurs, one region out of every pair is prioritized to make sure at least one is restored as quickly as possible for applications hosted in that region pair. - Planned Azure updates are rolled out to paired regions one region at a time to minimize downtime and risk of application outage. - Data continues to reside within the same geography as its pair (except for Brazil South) for tax- and law-enforcement jurisdiction purposes.

How many datacenters do availability zones have?

1 or more

Azure Sphere comes in three parts:

1. Azure Sphere micro-controller unit (MCU): to process OS and sensor signals 2. customized Linux OS: to communicate with security service and run vendor's software 3. Azure Sphere Security Service (AS3): ensure device is not maliciously compromised by authenticating each device via certificates and checking for tampering

Implementing a policy in Azure Policy involves three tasks:

1. Create a policy definition 2. Assign the definition to resources 3. Review the evaluation results

Implementing a blueprint in Azure Blueprints involves these three steps:

1. Create an Azure blueprint. 2. Assign the blueprint. 3. Track the blueprint assignments.

Cloud Adoption Framework consists of tools, documentation, and proven practices. What are the 5 stages it includes?

1. Define your strategy 2. Make a plan 3. Ready your organization 4. Adopt the cloud 5. Govern and manage your cloud environments

Working with the TCO Calculator involves three steps:

1. Define your workload 2. adjust assumptions 3. view report

There are two basic approaches to AI:

1. deep learning: system that's modeled on the neural network of the human mind, enabling it to discover, learn, and grow through experience 2. machine learning: data science technique that uses existing data to train a model, test it, and then apply it to new dat to forecast future behaviors, outcomes, and trends

What is included in most CI/CD pipelines

1. get most recent code from source code mgmt system & update dependencies/packages 2. compile source code into binary executable 3. remove compiled binary to location where it can be deployed to a test environment for further testing 4. binary and other files get deployed to prod

he maximum number of network Azure ExpressRoute circuits per subscription is

10

how may management groups can be supported in a single directory

10,000

99.9% availability means how much downtime per week?

10.1 minutes

, if you reduce the VM's size from Standard_D4_v4 to Standard_D2_v4, which is the next size lower, you reduce your compute cost by

50% 5esizing a VM requires it to be stopped, resized, and then restarted -- but saves money if its underutilized

You have a current composite SLA of 99.78, you want to add 2 new services each with a SLA of 99.9, what is your new composite?

99.58%

SQL Database provides _______ percent availability.

99.99

Billing zones

A geographical grouping of Azure Regions for billing purposes. Zone 1: Australia Central, West US, East US, Canada West, West Europe, France Central, ++ Zone 2: Australia East, Japan West, Central India, Korea South, ++ Zone 3: Brazil South, South Africa North, South Africa West, UAE Central, UAE North DE Zone 1: Germany Central, Germany Northeast

Hybrid cloud

A hybrid cloud is a computing environment that combines a public cloud and a private cloud by allowing data and applications to be shared between them.

Azure Machine Learning

A platform for making predictions. It consists of tools and services that allow you to connect to data to train and test models to find one that will most accurately predict a future result. After you've run experiments to test the model, you can deploy and use it in real time via a web API endpoint.

Private cloud

A private cloud consists of computing resources used exclusively by users from one business or organization. A private cloud can be physically located at your organization's on-site (on-premises) datacenter, or it can be hosted by a third-party service provider.

Site-to-site virtual private networks

A site-to-site VPN links your on-premises VPN device or gateway to the Azure VPN gateway in a virtual network. In effect, the devices in Azure can appear as being on the local network. The connection is encrypted and works over the internet.

Subscriptions

A subscription groups together user accounts and the resources that have been created by those user accounts. For each subscription, there are limits or quotas on the amount of resources that you can create and use. Organizations can use subscriptions to manage costs and the resources that are created by users, teams, or projects.

serverless computing

A type of cloud computing that allows companies to focus on building a business function using code without worrying about how to deploy - enables developers to build applications faster by eliminating the need for them to manage infrastructure (like Paas) Azure executes your code based on triggers and handles the servers and running of code for you; can autoscale for demand; don't need to worry about outages; only pay for what you use

you can use existing data to forecast future behaviors; build use and deploy machine learning models in the cloud using this service category

AI

What is the best infrastructure-as-code option for quickly and reliably setting up your entire cloud infrastructure declaratively?

ARM Templates

used when you need a highly reliable means of deploying a complex set of services that perform different roles in your app architecture

ARM Templates

What should you use to manage resources if you need to repeatedly set up one or more resources and ensure that all the dependencies are created in the proper order

ARM templates PowerShell and Azure CLI could be used, but there'd be no validation, hard to rollback if there's an error, and more difficult to save previous scripts

The company needs a repeatable, reliable way to scale its operations during peak sales periods. - it should be efficient and maybe parallel - create dependencies in the correct order - and not fail in the middle of deployment What can you use?

ARM templates - we're basically deploying an entire cloud infrastructure and we want to repeat this during peak times PowerShell or Azure CLI could be used, but less efficient an could fail in the middle etc

Azure VPN Gateway

Accesses Azure Virtual Networks through high-performance VPN gateways.

Active Directory v. Azure AD

Active Directory = on prem resource run on a Windows server to provide identity and access mgmt that is managed by your org Azure AD = cloud based identity and access mgmt, you control the accounts but Microsoft ensures the service is globally available and can monitor and detect suspicious sign-in attempts (unexpected location/device, etc)

Bing Search

Add Bing Search APIs to your apps and harness the ability to comb billions of webpages, images, videos, and news with a single API call.

Azure SignalR Service

Add real-time web functionalities easily.

Natural Language processing

Allow your apps to process natural language with prebuilt scripts, evaluate sentiment, and learn how to recognize what users want.

Web API

An API that's accessible from servers that accept requests via HTTP

Azure Functions

An event-driven, serverless compute service.

How can VMs be used when extending your datacenter to the cloud?

An organization can extend the capabilities of its own on-premises network by creating a virtual network in Azure and adding VMs to that virtual network. e.g. run SharePoint on an Azure VM instead of locally

you can quickly build, deploy, and scale enterprise-grade web, mobile, and API apps running on any platform. You can meet rigorous performance, scalability, security, and compliance requirements while using a fully managed platform to perform infrastructure maintenance. What is this?

App Service

What is likely the best way for you to identify which billing department each Azure resource belongs to?

Apply a tag to each resource that include the billing department (could split by subscriptions too - but less good)

Resources in the Dev and Test environments are each paid for by different departments. What's the best way to categorize costs by department?

Apply a tag to resources to identify the appropriate billing department

What's the best way to ensure that the development team doesn't provision too many virtual machines at the same time?

Apply spending limits to the team's Azure subscription

What blob storage tier should you use for long-term backups or disaster recovery

Archive access tier - for data that is rarely accessed and stored for at least 180 day

AuthN

Authentication

How can you connect Active Directory with Azure AD in order to provide a consistent identity experience to your users?

Azure AD Connect

synchronizes user identities between on-premises Active Directory and Azure AD so you can support SSO, MFA, and self-service password changes

Azure AD Connect

To monitor your actual costs and get recommendations around unused resources and ways to optimize services you can use

Azure Advisor

What dashboard in Portal displays personalized recommendations for all your subscriptions, and you can use filters to select recommendations for specific subscriptions, resource groups, or services

Azure Advisor

What should you use to get recommendation on how to optimize your cloud environment?

Azure Advisor

What should you use to get recommendations on how to cut costs?

Azure Advisor

You want to be alerted when new recommendations to improve your cloud environment are available. Which service will do this?

Azure Advisor

You need to analyze how you're using Azure to reduce costs, improve resilience, and harden your security. What should you use?

Azure Advisory - for an analysis of your deployed resources

This platform as a service (PaaS) environment allows you to focus on the website and API logic while Azure handles the infrastructure to run and scale your web applications.

Azure App Service

scalable hosting platform for web based apps where you can easily deploy, operate, and scale apps

Azure App Services

service for sending telemetry information from application source code to Azure

Azure Application Insights

- Starts a pool of compute VMs for you. - Installs applications and staging data. - Runs jobs with as many tasks as you have. - Identifies failures. - Requeues work. - Scales down the pool as work completes. What am I?

Azure Batch

this type of storage can manage thousands of simultaneous uploads, massive amounts of video data, constantly growing log files, and can be reached from anywhere with an internet connection.

Azure Blob Storage

Which Azure Storage option is better for storing data for backup and restore, disaster recovery, and archiving

Azure Blob Storage (Question asked for Azure Storage type, not access tier)

You need to create a human-computer interface that uses natural language to answer customer questions. Which product option should you select as a candidate?

Azure Bot Service

you need to create a virtual agent to interact with humans by using natural language which AI service should you use

Azure Bot Service

The Customer Service team has long asked for a virtual agent to handle the vast majority of questions it gets asked. No matter how prominent it makes the answers to the most frequently asked questions on the website, shoppers are impatient and perceive contact in a chat window as saving them time. The team wants shoppers to feel as though they're interacting with a real human. When it becomes clear that the virtual agent can't provide an answer, the chat session should be transferred to a human. Providing a virtual agent would decrease the amount of time it takes for all shoppers to receive answers. The virtual agent could answer most questions, which would free up human customer service agents to provide support for more difficult questions or thorny account-related issues. What service should you use?

Azure Bot Service we want to chat with a person-like thing = bot we have FAQs and other data to train it with = bot We could also use QnA Maker or other tools alongside this solution

As an administrator, you need to retrieve the IP address from a particular VM by using Bash, what tool should you use?

Azure CLI - Bash = Azure CLI

A team of Linux developers needs to check on the health of Azure resources and keep everything up and running via a variety of tasks, and Portal is too slow, what can they use?

Azure CLI - one off tasks with Linux background

Is PowerShell or Azure CLI better for people familiar with Linux?

Azure CLI for Linux people PowerShell for Windows people but either can be used on either OS - just preferance

You need to identify the content of product images to automatically create alt tags for images formatted properly. Which product option is the best candidate?

Azure Cognitive Service

only 80 percent of potential customers speak English. In some neighborhoods, that number falls to 50 percent. The team sees the addition of multiple languages as a wonderful opportunity to serve non-English speakers with the same online e-commerce experience as English speakers. What service should you use?

Azure Cognitive Services We want to translate and understand text = cognitive service

You need a service that can understand the content and meaning of images, video, or audio, and translate text into a different language What should you use?

Azure Cognitive Services speech to text; analyzing text; etc.

to solve general problems, such as analyzing text for emotional sentiment or analyzing images to recognize objects or faces, you can use

Azure Cognitive Services (via APIs to include in your code)

you need to predict user behavior and provide users with personalized recommendations in your app What should you use?

Azure Cognitive Services Personalizer watches your users' actions within an application. You can use Personalizer to predict their behavior and provide relevant experiences as it identifies usage patterns. Azure Machine Learning could also be used

these two services allow you to deploy containerized apps with fully managed services

Azure Container Instances and Azure Kubernetes Service

Allows developers to create apps fast with their choice of APIs, such as MongoDB, Cassandra, Gremlin, and more.

Azure Cosmos DB

Your development team is interested in writing Graph-based applications that take advantage of the Gremlin API. Which db option would be ideal for that scenario?

Azure Cosmos DB

________ supports schema-less data, which lets you build highly responsive and "Always On" applications to support constantly changing data. You can use this feature to store data that's updated and maintained by users around the world.

Azure Cosmos DB

An attacker can bring down your website by sending a large volume of network traffic to your servers. Which Azure service can help protect your App Service instance from this kind of attack?

Azure DDoS Protection

You can migrate your existing SQL Server databases with minimal downtime by using

Azure Database Migration Service - it performs all of the required steps. You just change the connection string in your apps.

_____________ offers several service tiers, and each tier provides different performance and capabilities to support lightweight to heavyweight database workloads. Dynamic scalability enables your database to transparently respond to rapidly changing resource requirements. You only pay for the resources you need, and only when you need them.

Azure Database for MySQL

a company uses the LAMP (Linux, Apache, MySQL, and PHP) stack for several of its websites. Which option would be ideal for migration?

Azure Database for MySQL

a suite of services that address every stage of the software development lifecycle

Azure DevOp

Is DevOps or GitHub more sophisticated for project management and reporting?

Azure DevOps

The team needs to give project sponsors and managers executive level reporting, including burndown charts, track progress against epics, and track custom information that's specific to the company in each work item and bug report. upper management team wants to ensure that contractors only have access to the information they need to do their work What should be used to do this?

Azure DevOps - its not open source and needs robust permissions and project mgmt = DevOps

Should you use Azure DevOps or GitHub for more complex permissions

Azure DevOps, bc GitHub works on a simple model of read/write permissions to every feature while DevOps has a much more granular set of permissions

Which service could help you manage the VMs that your developers and testers need to ensure that your new app works across various operating systems?

Azure DevTest Labs

provides an automated means of managing the process of building, setting up, and tearing down virtual machines (VMs) that contain builds of your software projects so developers and testers can perform tests across a variety of environments and builds

Azure DevTest Labs

Typical usage scenarios of this storage type would be to share files anywhere in the world, diagnostic data, or application data sharing.

Azure Files

You need to process messages from a queue, parse them by using some existing imperative logic written in Java, and then send them to a third-party API. Which serverless option should you choose?

Azure Functions

create vent driven serverless apps (with no coding required) using

Azure Functions

host a single method or function by using a popular programming language in the cloud that runs in response to an event. An example of an event might be an HTTP request, a new message on a queue, or a message on a timer. What service does this

Azure Functions

ideal when you're concerned only about the code running your service and not the underlying platform or infrastructure. They're commonly used when you need to perform work in response to an event (often via a REST request), timer, or message from another Azure service, and when that work can be completed quickly, within seconds or less. What are these

Azure Functions

If you need to use build complex algorithms, or data lookup and parsing operations then you should use this serverless compute option

Azure Functions if you have a logic-intensive orchestration that requires a complex algorithm, implementing that algorithm might be more verbose and visually overwhelming in Logic Apps --> Functions is better

Data about each product that's sold is packaged as a JSON message and sent to an event hub. The event hub distributes the JSON message to subscribers, which allows various systems to be notified. upgrade its e-commerce site to include real-time inventory tracking, but currently does so one a day using a Windows service on a VM in Azure that is written in C# to retrieve messages, parse JSON, perform lookups of db info, and send notifications as necessary. Which serverless option should be used?

Azure Functions port the Windows Service code into an Azure Function and make the necessary changes bind the function to a trigger so it runs whenever a new message is on the queue

Azure Functions v. Logic Apps pricing

Azure Functions pricing is based on the number of executions and the running time of each execution. Logic Apps pricing is based on the number of executions and the type of connectors that it utilizes.

With this IoT service, the visual user interface (UI) makes it easy to quickly connect new devices and watch as they begin sending telemetry or error messages. You can watch the overall performance across all devices in aggregate, and you can set up alerts that send notifications when a specific device needs maintenance. Finally, you can push firmware updates to the device.

Azure IoT Central

If you primarily want to send messages with your IoT devices and occasionally push updates, and don't need further reporting features, you should use

Azure IoT Hub

By using this service, devices that are equipped with sensors and that can connect to the internet could send their sensor readings to a specific endpoint in Azure via a message. The message's data is then collected and aggregated. Devices could also be updated with new firmware to fix issues or add functionality by sending software updates from this services to each device.

Azure IoT services

What is the best way for your company to safely store its certificates so that they're accessible to cloud VMs?

Azure Key Value

You want to orchestrate a workflow by using APIs from several well-known services. Which is the best option for this scenario?

Azure Logic Apps

Your team has limited experience with writing custom code, but it sees tremendous value in automating several important business processes. Which of the following options is your team's best option?

Azure Logic Apps

low-code/no-code development platform hosted as a cloud service. The service helps you automate and orchestrate tasks, business processes, and workflows when you need to integrate apps, data, systems, and services across enterprises or organizations. simplifies how you design and build scalable solutions, whether in the cloud, on-premises, or both. This solution covers app integration, data integration, system integration, enterprise application integration (EAI), and business-to-business (B2B) integration.

Azure Logic Apps

A store sends out surveys for customer satisfaction. Ideally, negative customer satisfaction scores would trigger a customer retention workflow. First, a sentiment analysis would be generated based on the free-form comments, an email would be sent to the customer with an apology and a coupon code, and the message would be routed to the Dynamics 365 customer service team so that it could schedule a follow-up email. No developers are available to work on this, but IT staff are. What serverless solution should be used?

Azure Logic Apps A cloud or IT professional could use existing connectors to perform a sentiment analysis by using the Azure Cognitive Services connector, send an email by using the Office 365 Outlook connector, and create a new record and follow-up email by using the Dynamics 365 customer service connector. Because Azure Logic Apps is a low-code/no-code service, no developers are needed. A cloud or IT professional should be able to build and support this workflow.

You need to build a model based on historical data, what AI service should you use?

Azure Machine Learning

when your data scientists need complete control over the design and training of an algorithm using your own data you should use

Azure Machine Learning

The Marketing team is convinced that it can increase sales dramatically by suggesting add-on products that complement the items in a shopper's cart at the point of checkout. The team could hard-code these suggestions, but it feels that a more organic approach would be to use its years' worth of sales data as well as new shopping trends to decide what products to display to the shopper. Additionally, the suggestions could be influenced by product availability, product profitability, and other factors. What service should you use?

Azure Machine Learning Azure Cognitive Services Personalizer could play a role as it deals with predicting users, but we need a more complex model with historical data sets so this leads us to something more flexible that can still predict future outcomes = machine learning

You need to predict future behavior based on previous actions. Which product option should you select as a candidate?

Azure Machine Learning (potentially Azure Cognitive Service Personalizer if we were given more info)

You need to build a model by using your own data, what AI service should you use?

Azure Machine Learning as it is maximumly flexible

If you want to track how your Azure services are performing and diagnose issues, you should use

Azure Monitor

Which service is a platform that powers Application Insights, monitoring for VMs, containers, and Kubernetes?

Azure Monitor

You want to measure custom events alongside other usage metrics and telemetry, what should you use?

Azure Monitor

You want to keep track of the performance or issues related to your specific VM or container instances, databases, your applications, and so on, what should you use?

Azure Monitor to create reports and notifications to help you understand how your services are performing or diagnose issues related to your Azure usage

Your e-commerce website is experiencing intermittent errors, and the team is unsure of the cause. Because of the nature of the errors, the team suspects that it's either a database or caching issue. What are the circumstances surrounding the errors? Does it happen only during peak usage times? What is the state of the team's Azure SQL instance? What is the state of its Redis caching server? How can it trace the issues to a root cause? What service should you use to answer these questions?

Azure Monitor - to gain insight on performance and specific issues additional information about the state of the web application can be sent to Application Insights to help locate the root cause of the issue as well

Where can you create custom views by using Power BI and Kusto queries.

Azure Monitor Dashboard

what lets you use data to help you react to critical events in real time, through alerts delivered to teams via SMS, email, and so on. Or use thresholds to trigger autoscaling functionality to scale up or down to meet the demand.

Azure Monitor Dashboard

What can be used to automate CI/CD processes?

Azure Pipelines & GitHub Actions

If all resources in a certain resource group should be tagged with AppName tag and a value of "SpecialOrders," and one is created without this tag under Azure Policies, what happens?

Azure Polices will automatically reapply the tag (or add it for the first time) if it is missing

CORS should not allow every resource to access your web apps - how can you enforce this?

Azure Policies

How can you make sure new resources use the same tags as existing resources?

Azure Policies

MFA should be enabled on accounts with write permissions on your subscription - how can you enforce this?

Azure Policies

You want to restrict which locations your organization can specify when it deploys a resource. How can you do this?

Azure Policies

Lets you create, configure, and control all your services and resources from a single easy to use web-based interface

Azure Portal

Where can you manage your Azure subscription using a GUI

Azure Portal

a web-based, unified console that provides an alternative to command-line tools

Azure Portal

You're a developer who needs to set up your first VM to host a process that runs nightly. Which of the following tools is your best choice?

Azure Portal - your *first VM, and a one-off task = portal

Your financial officer want to run custom reports in real time to see how resources are being used and cost, what should you use?

Azure Portal, bc we are doing one-time tasks and the person is non-technical

if you're in a cloud management or administrative role, it's less efficient to rely solely on visual scanning and clicking so you should use _______ for one-off resource mgmt stuff

Azure PowerShell or Azure CLI

What can you use to perform one-off mgmt , administrative, or reporting actions in Azure

Azure Powershell, Azure CLI, or Azure Portal

allows you to distribute you applications globally so you can locative your data and apps where they're needed most

Azure Regional Datacenters

ARM

Azure Resource Manager

Instead of defining the detailed access requirements for each individual, and then updating access requirements when new resources are created, Azure enables you to control access through

Azure Role Based Access Control (Azure RBAC)

a relational database based on the latest stable version of the Microsoft SQL Server database engine. This db is a high-performance, reliable, fully managed, highly available, and secure database. You can use it to build data-driven applications and websites in the programming language of your choice, without needing to manage infrastructure.

Azure SQL Database

a scalable cloud data service that provides the broadest SQL Server database engine compatibility with all the benefits of a fully managed PaaS.

Azure SQL Managed Instance

Provides recommendations on how to improve security posture based on your current configurations, resources, and networks

Azure Security Center

What can automatically detect potential inbound attacks like logins from malicious IPs, suspicious commands being run, etc

Azure Security Center

place to check security settings, identify potential security weaknesses, and analyze inbound attacks

Azure Security Center

provides visibility of your security posture across all of your services, both on Azure and on-premises

Azure Security Center

Where can you get a detailed analysis of different components and whether they comply with certain security regulations?

Azure Security Center (policy & compliance section)

aggregates security data from many different sources, and provides additional capabilities for threat detection and response

Azure Sentinel

After an outage, this service provides official incident reports, called root cause analyses (RCAs), which you can share with stakeholders.

Azure Service Health

Your cloud operations team wants to let stakeholders know about upcoming planned downtime in advance. When outages do happen, the team wants to quickly ascertain whether the issue is specific to their services or a service interruption that affects many Azure customers. The team also wants to provide key stakeholders with reports that explain how and why the incident occurred, and so on. What should they use?

Azure Service Health

You want to monitor Azure services and regions, what should you use?

Azure Service Health for status of services and outages

If you want to stay no top of planned outages you should use

Azure Service Helth

A company wants to build a new voting kiosk for sales to governments around the world. Which IoT technologies should the company choose to ensure the highest degree of security?

Azure Sphere

When security of IoT devices is of critical consideration, you'll want to use

Azure Sphere bc it ensures a secure channel of communication between the device and Azure by controlling everything from the hardware to the operating system and the authentication process

A company wants to implement a touchless point-of-sale solution for self-checkout. The self-checkout terminals should be, above all else, secure. Each terminal must be impervious to malicious code that could create fraudulent transactions, force the company to take the systems offline during a heavy shopping period, or send transactional data to a spying organization. The terminals should also report back vital information on the company's health and allow secure updates to its software remotely. They also want a way to push updates to its terminals and also make sense of all of the data that will be generated through analysis. What IoT Service should be used + why?

Azure Sphere with Iot Central Security is important = sphere Iot Central can also provide the analytics the company is looking for so building on top of both makes sense

A company has millions of log entries that it wants to analyze. Which db option would be ideal for analysis?

Azure Synapse Analytics

Where can the IT department find reference blueprints that it can apply directly to its Azure subscriptions?

Azure compliance doucmentation

on-demand computing service for running cloud-based applications. It provides computing resources such as disks, processors, memory, networking, and operating systems. The resources are available on-demand and can typically be made available in minutes or even seconds. You pay only for the resources you use, and only for as long as you're using them.

Azure compute

Meeting the European Union Model Clauses ensures

Azure customers can use Microsoft services to move data freely through Microsoft's cloud, from Europe to the rest of the world

Linking compute resources and providing access to applications is the key function of

Azure networking

How can you access previews?

Azure portal create a resource and search "preview"

You can create and configure Azure Virtual Network instances using

Azure portal, Azure PowerShell on your local computer, or Azure Cloud Shell

How do you know when there's a service outage?

Azure status provides a global view of the health of Azure services and regions -- good starting place You can subscribe to Azure Status for updates via RSS feed You can access Azure Service Health from here too, for a personalized view the health of services and regions your are using

Your company has a team of remote workers that need to use Windows-based software to develop your company's applications, but your team members are using various operating systems like macOS, Linux, and Windows. Which Azure compute service would help resolve this scenario?

Azure virtual desktop

empower developers and data scientists a wide range of productive experiences for building, training, and deploying machine learning models faster

Azure's AI and ML services

Azure Load Balancer

Balances inbound and outbound connections to applications or service endpoints.

Azure Database for PostgreSQL Single Server pricing tiers

Basic, General Purpose, and Memory Optimized. Each tier offers different resource capabilities to support your database workloads. You can build your first app on a small database for a few dollars a month, and then adjust the scale to meet the needs of your solution. Dynamic scalability enables your database to transparently respond to rapidly changing resource requirements. You only pay for the resources you need, and only when you need them.

for large amounts of data, you can use open source cluster services to run analytics at a massive scale and make decisions based on complex queries using this service category

Big Data

BGP

Border Gateway Protocol; used to exchange routes between on-premises networks and resources running in Azure. This protocol enables dynamic routing between your on-premises network and services running in the Microsoft cloud.

you might need a single invoice for your organization but want to organize charges by department, team, or project how can you do this?

Break up your resources by subscriptions for separate departments But then have a invoice section for the subscriptions you want on a single invoice

How can you improve your secure score?

By remediating all of the recommendations for a single resource within a control

Stages of CI pipeline and CD pipeline

CI: plan, code, build, test CD: release, deploy, operate, monitor

Security posture is your organization's ability to protect from and respond to security threats. The common principles used to define a security posture are

CIA confidentiality integrity availability

What are the lock levels?

CanNotDelete - authorized people can modify/read but not delete ReadOnly - authorized people can not delete or change

requires significant up-front financial costs

CapEx

View the report with TCO calculator

Choose a time frame between one and five years and TCO will generate a report for you based on the info you entered view costs breakdowns for on prem v. Azure in categories: compute, datacenter, networking, storage, and IT labor

Offers a collection of documents, implementation guidance, best practices, and tools for each of those things

Cloud Adoption Framework

Azure Machine Learning Service

Cloud-based environment you can use to develop, train, test, deploy, manage, and track machine learning models. It can auto-generate a model and auto-tune it for you. It will let you start training on your local machine, and then scale out to the cloud.

Azure Kubernetes Service

Cluster management for VMs that run containerized services. a complete orchestration service for containers with distributed architectures and large volumes of containers. controls placement of pods (1+ container) on a cluster node staggers update deployments & can roll back horizontally scales automatically or manually networking stuff and api extensions

Azure ML Studio

Collaborative visual workspace where you can build, test, and deploy machine learning solutions by using prebuilt machine learning algorithms and data-handling modules.

What's the easiest way for a company to combine security data from all of its monitoring tools into a single report that it can take action on?

Collect security data in Azure Sentinel

Colocation at a cloud exchange for ExpressRoute

Colocated providers can normally offer both Layer 2 and Layer 3 connections between your infrastructure, which might be located in the colocation facility, and the Microsoft cloud. e.g. you can request a virtual cross-connection to the Microsoft cloud

composite SLA

Combining SLAs across different service offerings multiply the SLA of each individual service (by instance)

How can your IT department ensure that employees at the company's retail stores can access company applications only from approved tablet devices?

Conditional Access

Azure Virtual Network

Connects VMs to incoming virtual private network (VPN) connections.

Azure ExpressRoute

Connects to Azure over high-bandwidth dedicated secure connections. For environments where you need high bandwidth and security. ExpressRoute provides dedicated private connectivity to Azure that doesn't travel over the internet.

Azure compute resources that you can use to deploy and manage containers.

Container Instances and Azure Kubernetes Service

These are lightweight, virtualized application environments. They're designed to be quickly created, scaled out, and stopped dynamically. You can run multiple instances of these application on a single host machine What am I?

Containers e.g. Container Instances and Azure Kubernetes Service

Speech

Convert spoken audio into text, use voice for verification, or add speaker recognition to your app.

What blob storage tier should you use to access invoices for your customers

Cool access tie - for data that is infrequently accessed and stored for at least 30 da

Over the years, Tailwind Traders has acquired several smaller companies. Each of these companies had teams of developers who used different database services and various APIs to work with their data. You'd like to enable each of these teams to work with an environment where they can use their existing skills. What should you use?

Cosmos DB - which has the flexibility to use an API developers are comfortable with e.g. SQL, MongoDB, Cassandra, Tables, and Gremlin

How can your company most easily implement a deny by default policy so that VMs can't connect to each other?

Create a network security group rule that prevents access from another VM on the same network allows you to filter traffic to and from resources by source and destination IP address, port, and protocol

You want to enable Azure Security Center to recommend missing security system updates on your servers. How can you do this?

Create an Azure Policy (Enable Monitoring in Azure Security Center - which is actually an initiative with numerous policy defs in it to monitor different things in Security Center)

You want to specify a set of VM SKUs that your organization can deploy. How can you do this?

Create an Azure Policy specifying the allowed SKUs

Which is the best way for you to ensure that the team deploys only cost-effective virtual machine SKU sizes?

Create an Azure Policy that specified the allowed SKU sized

What is the first step that you would take in order to share an image file as a blob in Azure Storage?

Create an Azure Storage Account

How can a company enforce having only certain applications run on its VMs?

Create an application control rule in Azure Security Center

Web Apps feature of Azure App Service

Create and deploy mission-critical web apps at scale.

What's the best way for your company to limit all outbound traffic from VMs to known hosts?

Create application rules in Azure Firewall

How can you allow some users to control the virtual machines in each environment but prevent them from modifying networking and other resources in the same resource group or Azure subscription?

Create role assignments with Azure RBAC

Azure Virtual WAN

Creates a unified wide area network (WAN) that connects local and remote sites.

Azure Sphere

Creates an end-to-end, highly secure IoT solution that encompasses everything from the hardware and OS on the device to the secure method of sending messages from the device to the message hub. Built in communication and security for internet connected devices

CORS

Cross-Origin Resource Sharing

Which is the most efficient way for a testing team to save costs on virtual machines on weekends, when testers are not at work?

Deallocate the VMs when they are not in use

Why deallocate a VM without deleting its storage?

Deallocating a VM when you don't plan on using it for some time is just one way to minimize costs (cut out compute time and public IP address usage)

Azure Content Delivery Network

Delivers high-bandwidth content to customers globally.

Adding a third virtual machine reduces your composite SLA. How can you offset this reduction?

Deploy extra instances of the same VM across different availability zones in the same region

Azure Cognitive Search

Deploy this fully managed search as a service.

bring together people, process, and tech by automatizing software delivery using this service category

DevOps

Azure Service Fabric

Distributed systems platform that runs in Azure or on-premises.

Azure Traffic Manager

Distributes network traffic across Azure regions worldwide.

Common characteristic shared by azure storage services (5)

Durable and highly available with redundancy and replication. Secure through automatic encryption and role-based access control. Scalable with virtually unlimited storage. Managed, handling maintenance and any critical problems for you. Accessible from anywhere in the world over HTTP or HTTPS.

What is a region pair?

Each Azure region is always paired with another region within the same geography (such as US, Europe, or Asia) at least 300 miles away. This approach allows for the replication of resources (such as VM storage) across a geography that helps reduce the likelihood of interruptions because of events such as natural disasters, civil unrest, power outages, or physical network outages that affect both regions at once. If a region in a pair was affected by a natural disaster, for instance, services would automatically failover to the other region in its region pair.

ExpressRoute Built-in redundancy

Each connectivity provider uses redundant devices to ensure that connections established with Microsoft are highly available. You can configure multiple circuits to complement this feature. All redundant connections are configured with Layer 3 connectivity to meet service-level agreements.

Layers of defense in depth

Each layer provides protection so that if one layer is breached, a subsequent layer is already in place to prevent further exposure. - physical security - identity and access - perimeter - network - compute - application - data

What do the roles do in RBAC

Each role has an associated set of access permissions that relate to that role. When you assign individuals or groups to one or more roles, they receive all of the associated access permissions.

Which of the following options isn't a benefit of ExpressRoute? - Redundant connectivity - Consistent network throughput - Encrypted network communication - Access to Microsoft cloud services

Encrypted network communication is not provided. ExpressRoute does provide private connectivity, but it isn't encrypted.

Defense in depth: application

Ensure apps are secure and free of vulnerabilities. Store sensitive secrets in secure storage. Make security a design requirement Integrating security into the application development lifecycle

CIA availability

Ensure that services are functioning and can be accessed only by authorized users. Denial-of-service attacks are designed to degrade the availability of a system, affecting its users.

Microsoft Privacy Statement

Explains what personal data Microsoft collects, how Microsoft uses it, and for what purposes..

T/F Every region has support for availability zones

False

T/F Network traffic is unrelated to costs in Azure

False

T/F You need an Azure Subscription to use the TCO calculator

False

T/F You need to purchase an Azure account before you can use any Azure resources.

False

T/F Azure DevOps is a lighter-weight tool than GitHub

False - GitHub is lighter weight and focused on individual developers and open source, DevOps is focused on enterprise dev with more tools and access control

T/F Subscriptions within a management group do not automatically inherit the conditions applied to the management group.

False - all subscriptions automatically inherit from their management group

T/F An azure account can only have one subscription

False - could have multiple; maybe with different billing models

T/F Resources can not be moved between resource groups

False - many resources can be moved although some have limitations

T/F Public cloud takes a lot of CapEx to scale up

False - no CapEx is needed in public cloud

T/F with OpEx you are responsible for purchasing and maintaining your computing resources

False - only maintaining

T/F A management group and subscription can have more than one parent.

False - only support one parent

T/F Organizations have to pay for unused resources when they use the public cloud

False - orgs only pay for what they use

T/F You must choose a region for any service that you create

False - some global Azure services don't require you to select a particular region, such as Azure Active Directory, Azure Traffic Manager, and Azure DNS.

T/F Azure Database for PostgreSQL Single Server is free

False - the benefits are of no additional cost but to use the db you need a pricing tier (basic, general purpose, memory optimized)

T/F Organizations are not responsible for hardware maintenance and updates when they are private cloud

False - they are responsible for maintenance as a private cloud

T/F Resource groups can be nested

False - they can not

T/F ExpressRoute supports site-to-site virtual private networks

False - this is not an ExpressRoute model

T/F With CapEx you are only responsible for the computing resources you use

False - you pay an upfront cost no matter what you use

T/F Azure AD helps users access external resources while you manage the internal access rights

False; Azure AD can handle both external and internal resource access management

T/F You must bring your own training data to Azure Cognitive Service to train the model

False; Azure Cognitive Services has pre-trained models which can be used

T/F Azure Government provisions separate memory space for deployments to protect apps from the other non-government apps running on the same servers

False; Azure Government offers physical isolation from non-US government deployments and provides screened US personnel

T/F Azure Policies check resources on create to see if they are compliant and it is up to you to keep them compliant after that

False; Azure Policies do make sure resources or complicate on creation and can prevent noncompliant resources from being created but, they also evaluate resources and highlight ones that are not compliant when changes are made to the resources - and can sometimes fix non-compliant resource automatically

T/F Azure Firewall is stateless

False; Azure firewall is stateful

T/F deallocating a VM means you don't need to pay for it anymore

False; Deallocating a VM means that the VM is no longer running. But the associated hard disks and data are still kept in Azure. --> you cut compute time and public IP addr time, but still pay for disk storage

T/F Virtual Network only allows you to create a single isolated virtual network

False; It can create multiple isolated virtual networks

T/F Security Center does not advanced cloud defense capabilities for VMs

False; It does provide this for VMs, and also, network security, and file integrity

T/F you can apply tags to a resource group, and they will automatically applied to the resources within that resource group

False; They will not automatically apply to the resources within the resource group -- but you can accomplish this using Azure Policies

T/F You only pay for the VMs you deploy on a dedicated host

False; With dedicated hosts you pay for the host price (base don VM family, type, etc) independent of how many VMs you deploy to it bc you're just buying a physical server in Microsoft's cloud datacenter

T/F You can not get any reports when using IoT Hub

False; You can create a customized set of management tools and reports by using the IoT Hub RESTful API

T/F You must create role in order to use Azure RBAC

False; You can create custom roles, but there are also built-in roles

T/F Since policies are inherited by their parent scopes, you can not exclude a subscope from the parent scope of an Azure Policy

False; You can exclude a subscope from the policy assignment if there are specific child resources you need to be exempt from the policy assignment

T/F Azure VMs use Azure Disk Storage to store virtual disks. And you can use Azure Disk Storage to store a disk outside of a virtual machine.

False; You can not use Azure Disk Storage to store a disk outside a VM

T/F You can deploy more than one one VPN gateway in each virtual network

False; You can only deploy ONE per virtual network, but it can connect to multiple locations including other vNets and on-prem datacenters

T/F Azure Government is only available in one location for security

False; currently has 8 geographies

T/F Resources are evaluated to see if they meet Azure Policy requirement on a daily basis

False; hourly

T/F When you grant access at a parent scope using RBAC, those permissions are inherited by all child scopes that you specify should inhert

False; inheritance is automatic

T/F Azure Service Health only displays the major issues that broadly affect Azure customers

False; it also provides localized issues that affect you

T/F With ExpressRoute, your data still travels over the public internet, so it is exposed to the potential risks associated with internet communications

False; it does not travel over the public internet and is therefore not exposed to risks associated with internet communications

T/F Azure Security Center monitors your cloud-based resources to ensure they retain the correct security settings

False; it does this for both cloud and on-prem resources

T/F Azure SQL Database is a IaaS database engine

False; it is PaaS

T/F you need machine learning or data science knowledge to use azure cognitive services

False; no knowledge required

T/F Previews have their own SLA and promise of data protection, security, compliance, privacy, etc.

False; often previews have little or no guarantees and are not recommended for production use or critical workloads

T/F All blueprint artifacts must be configured

False; some have no additional parameters/configurations to handle e.g. Deploy threat detection on SQL servers

T/F Azure Policy does not have built in support for HIPAA and ISO 27001

False; there are initiative that support compliance with HIPAA and ISO 27001

T/F If you need to exceed the limit for resources in a subscription you can apply to increase the limit for a small fee

False; there's no flexibility to increase limits

T/F You lose your Azure services when you free trial ends

False; they are disabled

T/F Any customer claiming to be US Gov entity can use Azure Government

False; they must be validated

T/F You can elastically and independently scale throughput and storage across a single Azure region anywhere in the world using Cosmos DB

False; you can do this across any number of Azure regions worldwide, not just one

T/F To stay on top of outages and other incidents, you must regularly check the Azure Service Health dashboard

False; you can set up alerts to help you stay on top of incidents and downtime

T/F Condition Access if provided to all users for free

False; you need an Azure AD Premium P1 or P2 license. If you have a Microsoft 365 Business Premium license, you also have access to Conditional Access features.

T/F all storage accounts cost the same

False; you specify a type (such as block blob storage or table storage), a performance tier (standard or premium), and an access tier (hot, cool, or archive). These selections present different costs.

Azure Database for MariaDB

Fully managed and scalable MariaDB relational database with high availability and security.

Azure Database for MySQL

Fully managed and scalable MySQL relational database with high availability and security.

Azure Database for PostgreSQL

Fully managed and scalable PostgreSQL relational database with high availability and security.

IoT Central

Fully managed global IoT software as a service (SaaS) solution that makes it easy to connect, monitor, and manage IoT assets at scale.

Azure SQL Database

Fully managed relational database with auto-scale, integral intelligence, and robust security. allows you to build modern cloud apps with an always up-to-date relational database service that includes serverless compute, hyperscale storage, and automated features to optimize performance and durability.

Azure Cache for Redis

Fully managed service caches frequently used and static data to reduce data and application latency. create fast, scalable apps with an open-source compatible, in-memory data store.

IoT Edge

Fully managed service that allows data analysis models to be pushed directly onto IoT devices, which allows them to react quickly to state changes without needing to consult cloud-based AI models.

Azure Functions v. Logic Apps purpose

Functions = serverless compute service / programming Logic Apps = erverless orchestration service / workflow (you could use Azure Functions to orchestrate a long-running business process that involves various connections, but this was not its primary use case when it was designed.)

If you already have your orchestration or business logic expressed in C#, Java, Python, or another popular programming language should you use Functions or Logic Apps?

Functions bc you can port your code into the body of Azure Functions which might be easier than recreating with a Logic App

Your company hopes to publish an API that would allow third parties to integrate their own inventories of new and used items Although the internal implementation of the API is closed source, the company wants to create a set of examples that call the API to perform various actions and get feedback, issues, and feature requests What should be used to do this?

GitHub - it's open source, simple permissions, doesn't need intense project mgmt = GitHub

the preferred host for open-source software

GitHub Although Azure DevOps can publish public code repositories, visibility and general acceptance by the open-source development community

Azure Cosmos DB

Globally distributed, multi-model database service that supports NoSQL options. Developers can build apps with guaranteed low latency and high availability anywhere, at any scale. You can also migrate Cassandra, MongoDB, and other NoSQL workloads to the cloud.

How can you add, view, or delete locks in Azure portal?

Go to the Settings section of a resource's settings pane and then choose Locks

GitHub and GitHub Actions

Good for open source & widely accepted Developers can publish code, accept contributions, accept feedback and bug reports has a long history with public repositories and is trusted by tens of thousands of open-source project owners

You want to allow one user to manage VMs in a subscription and another to manage virtual networks. What can you do?

Grant RBAC at the resource and/or resource group level (depending on where the networks and VMs are deployed)

What allows Azure to provide a high guarantee of availability?

Having a broadly distributed set of datacenters

HIPAA

Health Insurance Portability and Accountability Act

What blob storage tier should you use to access images for your website

Hot access tier as this will be accessed frequently

An advantage of this cloud service model is rapid deployment of new compute devices. Setting up a new virtual machine is considerably faster than procuring, installing, and configuring a physical server. What cloud service model am I?

IaaS

Azure Virtual Networks are IaaS, PaaS, or SaaS?

IaaS

The most flexible cloud service model is

IaaS

This cloud service model is the closest to managing physical servers; a cloud provider will keep the hardware up-to-date, but operating system maintenance and network configuration is up to you as the cloud tenant. What cloud service am I?

IaaS

You configure and manage the hardware for your application in this cloud model

IaaS

the most flexible category of cloud services

IaaS - It aims to give you complete control over the hardware that runs your application. Instead of buying hardware, with IaaS, you rent it.

Multi-Tier Cloud Security Singapore granted Microsoft cloud services MTCS 584:2013 Certification for

Iaas, PaaS, and also SaaS Microsoft is the first global solution provider to receive this cert across all three

How can VMs be used in disaster recovery?

If a primary datacenter fails, you can create VMs running on Azure to run your critical applications and then shut them down when the primary datacenter becomes operational again.

RBAC uses an allow model which means

If one role grants you read permissions and another grants you write for the same resource, you will have both read and write permissions (instead of neither)

How do you define an Azure Policy Initiative?

In Portal of via command-line You can search for built-in initiatives or create your own

Zone-redundant gateways

In regions that support availability zones, VPN gateways and ExpressRoute gateways can be deployed in a zone-redundant configuration. This configuration brings resiliency, scalability, and higher availability to virtual network gateways. Deploying gateways in Azure availability zones physically and logically separates gateways within a region while protecting your on-premises network connectivity to Azure from zone-level failures. These gateways require different gateway SKUs and use Standard public IP addresses instead of Basic public IP addresses.

ISO

International Organization of Standards

enables devices to gather and then relay information for data analysis

IoT

you can connect, monitor, and manage all IoT assets; analyze data as it arrives from sensors and take action with it using this service category

IoT

A company wants to quickly manage its individual IoT devices by using a web-based user interface. Which IoT technology should it choose?

IoT Central

With this IoT Service you can control a single device or all devices at once, and you can set up alerts for certain conditions, such as a device failure.

IoT Central

if you want a pre-built customizable user interface with which you can view and control your devices remotely, you might prefer to start with

IoT Central

A company has a fleet of delivery vehicles with shipments of goods that have sensors to collected and monitor temperature, humidity, tilt, shock, light, and location. Their sensors will be from a third-party vendor. Goals of this system include: - Shipment monitoring with real-time tracing and tracking. - Shipment integrity with real-time ambient condition monitoring. - Security from theft, loss, or damage of shipments. - Geo-fencing, route optimization, fleet management, and vehicle analytics. - Forecasting for predictable departure and arrival of shipments. The company would prefer a pre-built solution to collect sensor and vehicle computer data and provide an interface that displays reports about shipments and vehicles. What IoT Service should be used + why?

IoT Central We definitely want a UI and lots of report capabilities and pre-built stuff which leads us away from the IoT Hub and toward IoT Central Although security is mentioned, it is not of upmost importance and the sensors the company has will be from a third-part vendor, therefore Azure Sphere is not the best option bc it can't provide its own hardware to take care of security and the UI capabilities of IoT Central are more important

You want to send messages from the IoT device to the cloud and vice versa. Which IoT technology can send and receive messages?

IoT Hub

A company has appliances that will send telemetry information to a centralized location, where the data can be analyzed and maintenance can be scheduled. The devices will not require remote control. They will merely be sending their telemetry data for analysis and pro-active maintenance. Because Tailwind Traders already has software in place for managing appliance maintenance requests, the company wants to integrate all functionality into this existing system. What IoT Service should be used + why?

IoT Hub bc security is not top priority we don't need Sphere and data will be analyzed with their existing system so we don't need Dashboard and other capabilities from IoT Central

Costs with Azure Virtual Desktop

It is available to you at no additional cost if you have an eligible Microsoft 365 license. Just pay for the Azure resources used by Azure Virtual Desktop. (bing your own licenses)

How can your IT department use biometric properties, such as facial recognition, to enable delivery drivers to prove their identities?

MFA

Machine Learning

Machine learning is a data science technique that allows computers to use existing data to forecast future behaviors, outcomes, and trends. Using machine learning, computers learn without being explicitly programmed.

Defense in depth: compute

Malware, unpatched systems, and improperly secured systems open your environment to attacks. The focus in this layer is on making sure that your compute resources are secure and that you have the proper controls in place to minimize security issues. Secure access to VMs Implement endpoint protection on devices and keep systems patched and current.

Knowledge mapping

Map complex information and data to solve tasks such as intelligent recommendations and semantic search.

provides support for several popular No-SQL APIs

Microsoft Cosmos DB

The ___________________ can generate assessment reports that provide recommendations to help guide you through required changes prior to performing a migration.

Microsoft Data Migration Assistant

Where can the team access details about the personal data Microsoft processes and how the company processes it, including for Cortana?

Microsoft Privacy Statement

What's Azure AD Multi-Factor Authentication?

Microsoft service that provides multifactor authentication

Azure Sentinel

Microsoft's cloud-based SIEM system. It uses intelligent security analytics and threat analysis.

What does the Online Services Terms OST apply to

Microsoft's online services that you license through a subscription, including Azure, Dynamics 365, Office 365, and Bing Maps

MVP

Minimum Viable Product

Azure Network Watcher

Monitors and diagnoses network issues by using scenario-based analysis.

MFA

Multifactor authentication

NIST

National Institute of Standards and Technology

Why combine Network security groups and Azure Firewall

Network security groups provide distributed network-layer traffic filtering to limit traffic to resources within virtual networks in each subscription. Azure Firewall is a fully stateful, centralized network firewall as a service. It provides network-level and application-level protection across different subscriptions and virtual networks. together they provide better defense-in-depth network security.

Azure table storage

NoSQL datastore for key-value pairs; cheap for semi-structured data

NoSQL means

Not only SQL More than just a relational db

VM cons

Only run one OS at a time (con if mult apps need different OSes) Starting VM can be slow bc it starts a whole computer

a consumption-based model of expenses

OpEx

Azure Application Gateway

Optimizes app server farm delivery while increasing application security. provides a web application firewall - which has centralized, inbound protection for your web apps against common exploits and vulnerabilities

Azure App Services provides a managed hosting environment where developers can upload their web applications, without having to worry about the physical hardware and software requirements. This is an example of what cloud service model?

PaaS

The cloud service to focus on app dev

PaaS

This cloud service model is a managed hosting environment. The cloud provider manages the virtual machines and networking resources, and the cloud tenant deploys their applications into the managed hosting environment. What cloud service am I?

PaaS

Azure Container Instance a IaaS, PaaS, or SaaS?

PaaS; allows you to upload your containers, which it runs for you

PCI DSS

Payment Card Industry Data Security Standard

Disadvantage of PaaS

Platform limitations. There can be some limitations to a cloud platform that might affect how an application runs.

Point-to-point Ethernet connection for ExpressRoute

Point-to-point connections provide Layer 2 and Layer 3 connectivity between your on-premises site and Azure. You can connect your offices or datacenters to Azure by using the point-to-point links.

CIA integrity

Prevent unauthorized changes to information - at rest (where its stored) - in transit (during transfers including local to cloud) e.g. using hashes

Azure DDoS Protection

Protects Azure-hosted applications from distributed denial of service (DDOS) attacks. helps protect your Azure applications by analyzing and discarding DDoS traffic at the Azure network edge, before it can affect your service's availability

Azure DNS

Provides ultra-fast DNS responses and ultra-high domain availability.

Azure API Management

Publish APIs to developers, partners, and employees securely and at scale.

Azure App Service

Quickly create powerful cloud web-based apps.

different geographical locations around the globe that contain Azure datacenters

Regions

Where can you see the health of resources from a security perspective categorized as low, medium, and high?

Resource security hygiene section of Azure Security Center

Resource groups

Resources are combined into resource groups, which act as a logical container into which Azure resources like web apps, databases, and storage accounts are deployed and managed. Good to break into resource type

How do you protect your resources once they've been deployed?

Role based access control to limit users to authorization adding locks to prevent deletion

Azure Synapse Analytics

Run limitless analytics at a massive scale by using a cloud-based enterprise data warehousing and big data analytics that takes advantage of massively parallel processing to run complex queries quickly across petabytes of data.

Which is the best first step a team should take to compare the cost of running environments on Azure versus in their datacenter?

Run the Total Cost of Ownership Calculator TCO

How can your company ensure that certain VM workloads are physically isolated from workloads being run by other Azure customers?

Run the VMs on an Azure Dedicated Host

How can your IT department reduce the number of times users must authenticate to access multiple applications?

SSO

In this cloud service model, the cloud provider manages all aspects of the application environment, such as virtual machines, networking resources, data storage, and applications. The cloud tenant only needs to provide their data to the application managed by the cloud provider. What cloud service am I?

SaaS

Is Azure DevOps IaaS, PaaS, or SaaS?

SaaS

Microsoft Office 365 provides a fully working version of Microsoft Office that runs in the cloud. All you need to do is create your content, and Office 365 takes care of everything else. This is an example of what cloud service?

SaaS

Users pay for the software they use on a subscription model with this cloud service model

SaaS

pay as you go pricing model is linked to which cloud service model

SaaS

software that's centrally hosted and managed for you and your users or customers. Usually one version of the application is used for all customers, and it's licensed through a monthly or annual subscription. What cloud service model is this?

SaaS

Azure Virtual Machine Scale Sets

Scaling for Windows or Linux VMs hosted in Azure.

Adaptive network hardening

Security Center can monitor the internet traffic patterns of the VMs, and compare those patterns with the company's current network security group (NSG) settings. From there, Security Center can make recommendations about whether the NSGs should be locked down further and provide remediation steps.

Azure Notification Hubs

Send push notifications to any platform from any back end.

the cloud service provider automatically provisions, scales, and manages the infrastructure required to run the code & architectures are highly scalable and event-driven, only using resources when a specific function or trigger occurs What is this called?

Serverless computing

Microsoft-covered cloud services are audited at least annually against the

Service Organization Controls (SOC) report framework by independent third-party auditors this covers controls for data security, availability, processing integrity, and confidentiality as applicable to in-scope trust principles for each service

SQL Server on Azure Virtual Machines

Service that hosts enterprise SQL Server apps in the cloud.

Azure Database Migration Service

Service that migrates databases to the cloud with no application code changes. allows you to accelerate your transition to the cloud using a simple, self-guided migration process.

Public cloud

Services are offered over the public internet and available to anyone who wants to purchase them. Cloud resources, such as servers and storage, are owned and operated by a third-party cloud service provider, and delivered over the internet.

Conditional Access Flow

Signals: collect info on user location, device, identity, etc Decision: about how much access to grant or deny and if MFA is needed Enforcement: to carry out the decision and prompt for MFA or deny access or grant access.

Azure Database for PostgreSQL is available in two deployment options:

Single Server and Hyperscale (Citus).

SSO

Single Sign-on enables users to remember only one ID and one password to access multiple applications - reduce what user must remember, reduce work to provide access to multiple user identities, reduce IT help for forgotten passwords, and etc.

Disadvantage of SaaS

Software limitations. There can be some limitations to a software application that might affect how users work. Because you're using as-is software, you don't have direct control of features.

Your company experiences surges in e-commerce traffic that coincide with national holidays and weekends. In the past employees would come in to keep an eye on stuff, but the manager wished they could do this from how. How can this be done?

The Azure Mobile App - we want to handle stuff on the go, and it isn't really repeatable stuff

Bandwidth

The amount of data that can be transmitted over a network in a given amount of time.

REST API

The design of the URL style that's used to expose the API's functionality. Typically GET, PUT, POST, DELETE requests over HTTP

Web API endpoint

The location of the code library

CIA confidentiality

The principle of least privilege means restricting access to information only to individuals explicitly granted access, at only the level that they need to perform their work. This information includes protection of user passwords, email content, and access levels to applications and underlying infrastructure.

Point-to-site virtual private networks

The typical approach to a virtual private network (VPN) connection is from a computer outside your organization, back into your corporate network. In this case, the client computer initiates an encrypted VPN connection to connect that computer to the Azure virtual network.

Management groups

These groups help you manage access, policy, and compliance for multiple subscriptions. All subscriptions in a management group automatically inherit the conditions applied to the management group.

What does it means for Conditional Access to provide a more granular multifactor authentication experience for users

They need to authenticate with MFA only in certain cases - done by collecting signals from user (like location, device, etc) and making a decision about access rights and MFA from those signals e.g. If they are at a known location they may not be prompted for a 2nd factor of auth - but will at an unexpected location or if sign-ons are unusual

for a VPN gateway you need to create a Public IP address, explain

This address provides a public-routable IP address as the target for your on-premises VPN device. This IP address is dynamic, but it won't change unless you delete and re-create the VPN gateway.

OSI layer 2

This layer is the Data Link Layer, which provides node-to-node communication between two nodes on the same network.

OSI Layer 3

This layer is the Network Layer, which provides addressing and routing between nodes on a multi-node network

TCO

Total Cost of Ownership

TCO Calculator

Total Cost of Ownership helps you estimate the cost savings of operating your solution on Azure over time, instead of in your on-premises datacenters

T/F A management group tree can support up to six levels of depth. This limit doesn't include the root level or the subscription level.

True

T/F A subscription is a deployment boundary for Azure resources

True

T/F All capabilities that are available in the Azure portal are also available through PowerShell, the Azure CLI, REST APIs, and client SDKs

True

T/F All resources must be in a resource group

True

T/F All subscriptions and management groups are within a single hierarchy in each directory

True

T/F All subscriptions within a single management group must trust the same Azure AD tenant.

True

T/F Any number of Azure virtual machines or roles can mount and access the file storage share in Azure Files simultaneously.

True

T/F App Service has built-in load balancing and traffic manager provide high availability.

True

T/F App Service is a platform as a service (PaaS) offering.

True

T/F Azure Cosmos DB provides comprehensive service level agreements for throughput, latency, availability, and consistency guarantees.

True

T/F Azure Database for MySQL is a relational database service in the cloud with 99.99 percent availability

True

T/F Azure Firewall provides a central location to create, enforce, and log application and network connectivity policies across subscriptions and virtual networks.

True

T/F Azure Policy integrates with DevOps by applying CI/CD policies in pre-deployment and post-deployment

True

T/F Azure SQL Database handles most of the database management functions, such as upgrading, patching, backups, and monitoring, without user involvement

True

T/F Azure compliance documentation includes Audit reports

True

T/F Azure is the only major cloud provided that contractually commits to conformance with CJIS Security Policy to meet the same requirements as law enforcement and public safety entities

True

T/F Azure management groups provide a level of scope above subscriptions.

True

T/F Azure supports Saas, Paas, and IaaS

True

T/F Both Logic Apps and Functions are trigger based

True

T/F By default, VPN gateways are deployed as two instances in an active/standby configuration, even if you only see one VPN gateway resource in Azure

True

T/F Free products typically don't have an SLA

True

T/F Hardware must be purchased for start-up and maintenance of private clouds

True

T/F If a policy is applied to a resource group, that policy is applied to all resources within that resource group

True

T/F Organizations control security, compliance, or legal requirements when they are hybrid cloud

True

T/F Organizations have complete control over resources and security when they are private cloud

True

T/F Policy assignments are inherited by all child resources within that scope

True

T/F Preview features for existing services are available on deploy, configure, and mgmt

True

T/F Role based access control can be applied to the resource group

True

T/F SQL Database can be the right choice for a variety of modern cloud applications because it enables you to process both relational data and non-relational structures, such as graphs, JSON, spatial, and XML.

True

T/F Some services or VM features are only available in certain regions

True

T/F The IoT Hub service supports communications both from the device to the cloud and from the cloud to the device

True

T/F There's a minimum of three zones within a single region.

True

T/F To build enterprise integration solutions with Azure Logic Apps, you can choose from a gallery of 200+ connectors. The gallery includes services such as Salesforce, SAP, Oracle DB, and file shares

True

T/F Unlike virtual machines, you don't manage the operating system for a container.

True

T/F When a user sends a request from any of the Azure tools, APIs, or SDKs, Azure Resource Manager receives the request, authenticates it, authorizes it, and send it to the Azure service

True

T/F You can call Azure Functions from Azure Logic Apps and vice versa

True

T/F You store blobs in containers, which helps you organize your blobs depending on your business needs.

True

T/F Your storage account will contain all of your Azure Storage data objects, such as blobs, files, and disks

True

T/F a hypervisor can run multiple VMs with different OSes at the same time

True

T/F a resource can only be a member of a single resource group

True

T/F both Azure DevOps and GitHub allow public and private code repositories

True

T/F plans with 99.99% availability have max 1 minute of downtime per week

True

T/F the newest capabilities of SQL Server are released first to SQL Database, and then to SQL Server itself so you get the newest SQL Server capabilities, with no overhead for updates or upgrades, tested across millions of databases

True

T/F you can automate the provisioning of new labs as part of a toolchain by using Azure Pipelines or GitHub Actions

True

T/F you can choose to create subscriptions to set up separate environments for development and testing, security, or to isolate data for compliance reasons

True

T/F VPN gateways use a pre-shared key as the only method of authentication

True They also rely on also rely on Internet Key Exchange (IKE) t set up association between endpoint and Internet Protocol Security (IPSec) to encrypt and decrypt data packets in the VPN tunnel

T/F Resource groups are a scope for applying role-based access control (RBAC) permissions

True - easing admin work and limiting access

T/F You can apply access-management policies at the subscription level

True - this is called access control boundary you can create separate subscriptions to reflect different organizational structures like departments

T/F Cloud computing is a consumption-based model

True - you only pay for what you use

T/F If you delete a resource group, all resources contained within it are also deleted

True! Careful

T/F If you want to prevent users from gaining access to something you should use RBAC, but to audit resource use you should use Azure Policy

True; RBAC prevents! Azure Policy is more monitor-y

T/F When you set up a virtual network, you define a private IP address space by using either public or private IP address ranges

True; You can also divide that IP address space into subnets and allocate part of the defined address space to each named subnet.

T/F You can buy one-year or three-year Azure Reserved Virtual Machine Instances to save you up to 72 percent versus pay-as-you-go pricing.

True; You can pay for a reservation up front or monthly. Reservations provide a billing discount and don't affect the runtime state of your resources.

T/F Azure Sentinel supports a number of data sources, which it can analyze for security events including connectors for AWS

True; as long as logs are in an open-standard logging format

T/F You need to configure, update, and maintain the software that runs on the VM in Azure VM

True; but don't need to buy and maintain the physical hardware

T/F ARM Templates can even execute PowerShell and Bash scripts before or after the resource has been set up.

True; gives you the ability to utilize scripts for tasks that may not be possible with the ARM template itself

T/F ExpressRoute connections don't go over the public Internet.

True; this allows ExpressRoute connections to offer more reliability, faster speeds, consistent latencies, and higher security than typical connections over the Internet.

T/F Blueprints are versioned

True; to track and comment on changes to a blueprint

T/F You can configure a VPN gateway as a secure failover path for ExpressRoute connections

True; xpressRoute circuits have resiliency built in. But they aren't immune to physical problems that affect the cables delivering connectivity or outages that affect the complete ExpressRoute location. In high-availability scenarios, where there's risk associated with an outage of an ExpressRoute circuit, you can also provision a VPN gateway that uses the internet as an alternative method of connectivity. In this way, you can ensure there's always a connection to the virtual networks.

T/F You can have multiple dashboards generated from IoT Central

True; you can also integrate with IoT Hub to create reports, and target dashboard at a variety of users

T/F You can specify the relevant configuration parameters for a blueprint definition when you assign it to a scope

True; you can define it when the blueprint is created, or when you assign it to a scope this allows flexibility to specify relevant params at each scope e.g. different allowed locations for different resource groups

Where can the legal team access information around how the Microsoft cloud helps them secure sensitive data and comply with applicable laws and regulations?

Trust Center

Where can you find whether Azure meets a security standard or not?

Trust Center

The Health Insurance Portability and Accountability Act (HIPAA) is a

US federal law that regulates patient Protected Health Information (PHI).

How can you protect your organization's resources from network-based attacks (perimeter layer)?

Use Azure DDoS Protection to filter large-scale attacks before they can cause a denial of service for users. Use perimeter firewalls with Azure Firewall to identify and alert on malicious attacks against your network.

Your company wants to be more methodical and careful when it pushes new versions of its e-commerce website to production. The company will expand its quality assurance (QA) team, and it will use the cloud to create and host virtual machines (VMs). Through this approach, it will create testing environments that match the production environment. They don't want QA people having to configure stuff al the time, and doesn't want a bunch of VMs sitting around unused, what should they do?

Use Azure DevTest Labs

Suppose you need to test a new feature on an old version of an operating system. What can you do?

Use Azure DevTest Labs which can set up everything automatically upon request. After the testing is complete, DevTest Labs can shut down and deprovision the VM, which saves money when it's not in use. To control costs, the management team can restrict how many labs can be created, how long they run, and so on.

Team of developers with Windows experience want to perform one-off testing, mgmt, and other tasks and find Azure Portal too slow, what can they do?

Use Azure PowerShell - one off tasks with a Windows background

You want to allow a user to manage all resources in a resource group, such as virtual machines, websites, and subnets. How can you do this?

Use RBAC at the resource group level

You need to allow a database administrator group to manage SQL databases in a subscription. How can you grant this access?

Use RBAC on the subscription (or resource group/resource level if there are things they should not have access to)

Vision

Use image-processing algorithms to smartly identify, caption, index, and moderate your pictures and videos.

Azure DevTest Labs

Used to manage VMs for testing including configuration, provisioning, and automatic deprovisioning Can quickly create on-demand Windows and Linux environments to test or demo applications directly from deployment pipelines.

What if you want to configure governance and other requirements for your resources accross subscriptions? How can you do this?

Using Azure Blueprints ensures a dev team can build and deploy stuff rapidly while staying compliant

How can you automatically apply security settings to new resources when they are created?

Using Azure Security Center

How can you automated responses to security alerts in Secure Center?

Using a workflow automation with Azure Logic Apps and Security Center connectors triggered by a threat detection alert or by a Security Center recommendation Your logic app can then send an email and post a teams message in response

How do you manage Azure RBAC permissions?

Using the Access control (IAM) pane in the Azure portal The pane should who has access to what scope and what roles apply - you can also grant/remove access from this pane

Choosing VM v. Container

VM if needs complete control Container for portability and performance and more lightweight etc.

VM virtualize the ____________ while containers virtualize the __________________

VM virtualize the hardware while containers virtualize the OS

To start using Azure Firewall, you should build

VMs on a virtual network

Why use VMs for testing and development?

VMs provide a quick and easy way to create different OS and application configurations. Test and development personnel can then easily delete the VMs when they no longer need them.

All transferred data is encrypted in a private tunnel as it crosses the internet via

VPN/VPN gateway

These are typically deployed to connect two or more trusted private networks to one another over an untrusted network (typically the public internet).

VPNs Traffic is encrypted while traveling over the untrusted network to prevent eavesdropping or other attacks. VPNs use an encrypted tunnel within another network

Imagine you're running a website that enables scientists to upload astronomy images that need to be processed. If you duplicated the VM, you'd normally need to configure an additional service to route requests between multiple instances of the website. What can you use to have that work done for you?

Virtual Machine Scale Sets

These allow you to centrally manage, configure, and update a large number of VMs in minutes to provide highly available applications. The number of VM instances can automatically increase or decrease in response to demand or a defined schedule. What am I?

Virtual Machine Scale Sets

If you need complete control over your computing environment you should use

Virtual Machines

an Azure compute resource that you can use to deploy and manage a set of identical VMs. With all VMs configured the same, these are designed to support true autoscale. No pre-provisioning of VMs is required. What am I?

Virtual machine scale set

How can you stay updated the latest update to Azure products, services, features, products, and announcements?

Visit the Azure Updates page azure.microsoft.com updates filter by available, in preview, and in development browse or search updates, subscribe to a RSS feed to get notifications, and access Microsoft Connect to read product news and announcements

you can build, deploy, manage, and scale web apps and APIS using this service category

Web

Why combine Azure Application Gateway web application firewall and Azure Firewall

Web application firewall (WAF) is a feature of Azure Application Gateway that provides your web applications with centralized, inbound protection against common exploits and vulnerabilities. Azure Firewall provides: - Inbound protection for non-HTTP/S protocols (e.g. ssh) - Outbound network-level protection for all ports and protocols. - Application-level protection for outbound HTTP/S. Combining them provides more layers of protection.

Policy evaluation

When a condition is evaluated against your existing resources, each resource is marked as compliant or noncompliant. You can review the noncompliant policy results and take any action that's needed. If you make changes to your policy definition and create a policy assignment, that policy is evaluated over your resources within the hour. (are resources are re-evaluated hourly)

How can VMs be used during lift and shift?

When moving from a physical server to the cloud. You can create an image of the physical server and host it within a VM with little or no changes. Like a physical server, you must update the installed OS and the software it runs.

stateless v. stateful Azure functions

When they're stateless (the default), they behave as if they're restarted every time they respond to an event. When they're stateful (called Durable Functions), a context is passed through the function to track prior activity.

Azure costs by usage meters

When you provision a resource, Azure creates meters to track usage of that resource and determine billing e.g. CPU time, bandwidth, number of operations, size of resource, etc

How can DDoS (standard) Protection help manage cloud consumption

When you run on-premises, you have a fixed number of compute resources. But in the cloud, elastic computing means that you can automatically scale out your deployment to meet demand. A cleverly designed DDoS attack can cause you to increase your resource allocation, which incurs unneeded expense DDoS Protection Standard helps ensure that the network load you process reflects customer usage - and you can receive a credit for costs accrued from a DDoS attack

Azure Virtual Machines

Windows or Linux virtual machines (VMs) hosted in Azure.

Azure PowerShell is available for

Windows, Linux, and Mac, and you can access it in a web browser via Azure Cloud Shell.

Difference between functions and logic apps

With Functions, you write code to complete each step. With Logic Apps, you use a GUI to define the actions and how they relate to one another. functions are usually stateless, logic apps are always stateful functions can be run locally or in the cloud, logic apps are cloud only

Any-to-any networks with ExpressRoute

With any-to-any connectivity, you can integrate your wide area network (WAN) with Azure by providing connections to your offices and datacenters. Azure integrates with your WAN connection to provide a layer 3 connection like you would have between your datacenter and any branch offices.

Micro-billing in serverless computing

With serverless computing, you pay only for the time your code runs. If no active function executions occur, you are not charged.

How can you handling different types of billing requirements for resources

With subscriptions using it as a billing boundary Azure generates separate billing reports and invoices for each subscription so that you can organize and manage costs.

Does Azure Government have level 5 DoD approval?

Yep - and it offers the most compliance certifications of any cloud provider

Does Azure meet ISO 27001

Yes

Is there a difference in availability between 99% SLA and 99.9%?

Yes 99% means it can be down 7.2hr/month or 1.68 hr/week 99.9% means 43.2 min / month or 10 minutes a week

Does location of resources affect cost?

Yes, Different regions can have different associated prices And geographic regions can impact where your network traffic flows and therefore influence data transfer costs between regions

Should you deallocate virtual machines during off hours?

Yes; disks and data stay, deallocating saves money by for compute costs and this can be automated

Can the OS you choose affect costs?

Yes; so compare pricing if the OS doesn't matter to you

What approach might you take to add a preview service to your architecture?

You can create a new prototype version of the app that tests with smaller group of users

geo-distribution

You can deploy apps and data to regional datacenters around the globe, thereby ensuring that your customers always have the best performance in their region.

How can you prevent a lock from being removed?

You can specify it in your Azure Blueprints, then if the lock is removed it will be replaced

How can you use Azure Policy to manage tags?

You can use Azure Policy to ensure that a resource inherits the same tags as its parent resource group. Or to enforce tagging rules and conventions like added tags to new resources when they're made or reapplying tags that were removed

How can you delete/change a locked resource?

You must remove the lock (whether you are an owner of the resource or not)

Abstraction of servers in Serverless computing

You never explicitly reserve server instances. The platform manages that for you. Each function execution can run on a different compute instance. This execution context is transparent to the code. With serverless architecture, you deploy your code, which then runs with high availability.

Why is cloud computing typically cheaper to use?

You're billed only for what you use. it uses a pay-as-you-go pricing model. You typically pay only for the cloud services you use, which helps you: - Lower your operating costs. - Run your infrastructure more efficiently. - Scale as your business needs change.

What happens after your free trial subsription

Your Azure services are disabled when the trial ends or when your credit expires for paid products, unless you upgrade to a paid subscription

Azure services that support availability zones fall into three categories:

Zonal services: You pin the resource to a specific zone (for example, VMs, managed disks, IP addresses). Zone-redundant services: The platform replicates automatically across zones (for example, zone-redundant storage, SQL Database). Non-regional services: Services are always available from Azure geographies and are resilient to zone-wide outages as well as region-wide outages.

Azure's SLAs are represented as

a % representing availability also called uptime

Azure Pipelines

a CI/CD pipeline automation tool

You typically deploy Azure Firewall on

a central virtual network to control general network access

Azure Key Vault

a centralized cloud service for storing an application's secrets, such as passwords, encryption keys, and certificates, in a single, central location. It provides secure access to sensitive information by providing access control and logging capabilities.

toolchain

a combination of software tools that aid in the delivery, development, and management of software applications throughout a system's development lifecycle output of one tool is input for next tool in the chain e.g. automated dependency updates; building software; delivering artifacts to places

Containers are managed through

a container orchestrator, which can start, stop, and scale out application instances as needed.

Git

a decentralized source-code management tool

Azure Virtual Desktop

a desktop and application virtualization service that runs on the cloud. It enables your users to use a cloud-hosted version of Windows from any location. works across Windows, Mac, iOS, Android, and Linux less likely to have confidential info on personal device; separates desktop from user hardware can be full desktop or just certain apps

workload

a distinct capability or task that's logically separated from other tasks, in terms of business logic and data storage requirements defines a set of requirements for availability, scalability, data consistency, and disaster recovery

service-level agreement (SLA)

a formal agreement between a service company and the customer. For Azure, this agreement defines the performance standards that Microsoft commits to for you, the customer.

Define region

a geographical area on the planet that contains at least one but potentially multiple datacenters that are nearby and networked together with a low-latency network

Payment Card Industry (PCI) Data Security Standard (DSS)

a global standard seeks to prevent fraud through increased control of credit card data applies to any organization that stores, processes, or transmits payment and cardholder data

GitHub (+features)

a hosted version of Git that serves as - a shared source-code repository, including tools that enable developers to perform code reviews by adding comments and questions in a web view of the source code before it can be merged into the main code base. - facilitates project management, including Kanban boards. - supports issue reporting, discussion, and tracking. - features CI/CD pipeline automation tooling. - includes a wiki for collaborative documentation. - can be run from the cloud or on-premises

Online Services Terms OST

a legal agreement between Microsoft and the customer defines the obligations by both parties with respect to the processing and security of customer data and personal data

Azure Firewall

a managed, cloud-based network security service that helps protect resources in your Azure virtual networks by implementing high-security, high-availability firewall with unlimited scalability.

How can you manage resources across subscriptions?

a management group manages access, policies, and compliance across multiple Azure subscriptions

secure score

a measurement of an organization's security posture. which allows you to see how things change when you change your security stuff

Azure Security Center

a monitoring service that provides visibility of your security posture across all of your services, both on Azure and on-premises And provide centralized view of security alerts

A resource tag consists of

a name and value

firewall

a network security device that monitors incoming and outgoing network traffic and decides whether to allow or block specific traffic based on a defined set of security rules

Azure China 21Vianet

a physically separated instance of cloud services located in China and operated independently by 21Vianet

Policy assignment

a policy definition that takes place within a specific scope. This scope could be a management group (a collection of multiple subscriptions), a single subscription, or a resource group. This is how you assign definitions to resources.

ExpressRoute

a private connection from your on-premises infrastructure to your Azure infrastructure lets you extend your on-premises networks into the Microsoft cloud over a private connection with the help of a connectivity provider; you can establish connections to Microsoft cloud services, such as Microsoft Azure and Microsoft 365

Azure Artifacts

a repository for hosting artifacts, such as compiled source code, which can be fed into testing or deployment pipeline steps

What are scopes in RBAC?

a resource or set a resources access applied to can be - a management group (mult. subscriptions) - single subscription - resource group - single resource

Azure Government

a separate instance of the Microsoft Azure service addressing the security and compliance needs of US federal agencies, state and local governments, and their solution providers

Azure Policy

a service in Azure that enables you to create, assign, and manage policies that control or audit your resources. These policies enforce different rules across all of your resource configurations so that those configurations stay compliant with corporate standards.

Azure Storage

a service that you can use to store files, messages, tables, and other types of information App/clients can read and write data from Azure Storage Azure Storage is also used by IaaS virtual machines, and PaaS cloud services

Network virtual appliances

a specialized VM that can be compared to a hardened network appliance. A network virtual appliance carries out a particular network function, such as running a firewall or performing wide area network (WAN) optimization.

ISO 27001

a standard that applies to the security of IT systems, published by the International Organization for Standardization

What is a VM image

a template used to create a VM include an OS and often other software, like development tools or web hosting environments

Conditional Access

a tool that Azure Active Directory uses to allow (or deny) access to resources based on identity signals. These signals include who the user is, where the user is, and what device the user is requesting access from.

Containers

a virtualization environment - you can run multiple containers on a single physical or virtual host. lightweight and designed to be created, scaled out, and stopped dynamically. While it's possible to create and deploy virtual machines as application demand increases, containers are designed to allow you to respond to changes on demand.

You create logic app workflows by using

a visual designer on the Azure portal or in Visual Studio. The workflows are persisted as a JSON file with a known workflow schema.

Azure Policy initiatives

a way of grouping related policies together it contains all the policy definitions to help track compliance toward a larger goal

Azure Portal

a web-based user interface to view all the services you're using, create new services, configure your services, and view reports, pay for stuff for simple one-time mgmt tasks

STAR Certification is based on

achieving International Organization of Standards/International Electrotechnical Commission (ISO/IEC) 27001 certification and meeting criteria specified in the Cloud Controls Matric (CCM) involves rigorous independent third-part assessment of a cloud provider's security posture

Any US state or local agency that wants access to the FBI's Criminal Justice Information Services CJIS databases is required to

adhere to the CJIS Security Policy (Supported under compliance category US Gov in Azure)

Azure offers customers a HIPAA Business Associate Agreement (BAA), which stipulates

adherence to certain security and privacy provisions in HIPAA and the HITECH Act Microsoft offers a BAA to Azure customers as a contract addendum

Being able to deploy and configure cloud-based resources quickly as your app requirements change is called

agility

The Microsoft Privacy Statement covers

all of Microsoft's services, websites, apps, software, servers, and devices

Azure Database for PostreSQL

allows developers to build scalable, secure, an fully managed enterprise-ready apps. You can scale out single-nodes with high performance, or migrate PostgreSQL and Oracle workloads to the cloud.

Azure Hybrid Benefit

allows you to to repurpose software licenses on Azure -- saving costs

To begin using Azure Storage, you first create

an Azure Storage account to store your data objects. (done with Azure portal, PowerShell, or the Azure CLI)

Network security groups

an Azure resource that can contain multiple inbound and outbound security rules. You can define these rules to allow or block traffic, based on factors such as source and destination IP address, port, and protocol.

To create and use Azure services, you need

an Azure subscription

Azure Boards

an agile project management suite that includes Kanban boards, reporting, and tracking ideas and work from high-level epics to work items and issues.

why use VMs to run apps in the cloud?

an application might need to handle fluctuations in demand. Shutting down VMs when you don't need them or quickly starting them up to meet a sudden increase in demand means you pay only for the resources you use

Azure Test Plans

an automated test tool that can be used in a CI/CD pipeline to ensure quality before a software release.

landing zone

an environment in the cloud to begin hosting your workloads - includes cloud infrastructure as well as governance, accounting, and security capabilities

Azure account

an identity in Azure Active Directory (Azure AD) or in a directory that Azure AD trusts

Azure Data Lake Analytics

an on-demand analytics job service that simplifies big data you write queries to transform your data and extract valuable insights. The analytics service can handle jobs of any scale instantly by setting the dial for how much power you need. You only pay for your job when it's running, making it more cost-effective.

After a blueprint is made for a management group, the artifacts are deployed to

any existing subscriptions in the blueprint's scope (the mgmt group in this case), and any new subscriptions as they're created and added to the scope

A storage account provides a unique namespace for your Azure Storage data, that's accessible from

anywhere in the world over HTTP or HTTPS. Data in this account is secure, highly available, durable, and massively scalable.

__________ storage stores data offline and offers the lowest storage costs, but also the highest costs to rehydrate and access data

archive

Azure queue storage

asynchronous message queuing for communication between apps

AuthZ

authorization

unique physical location within an Azure region

availability zone - 1+ datacenters with independent power, cooling, networking, schedules for maintenance etc

You want to ensure your services and data are redundant so you can protect your information in case of failure. Azure can help make your app highly available through

availability zones

China East, China North are regions that are

available through a unique partnership between Microsoft and 21Vianet, whereby Microsoft doesn't directly maintain the datacenters.

Which of the following services should be used when the primary concern is to perform work in response to an event (often via a REST command) that needs a response in a few seconds? - Azure functions - Azure app service - Azure container instances

azure functions

_________ can act as an extension of your own datacenter into the cloud

azure virtual networks

You can access SLAs from

azure.microsoft.com support, legal, sla

Just-in-time VM access

blocks traffic by default to specific network ports of VMs, but allows traffic for a specified time when an admin requests and approves it.

What kinds of policies can be created with Azure Policy

both individual policies and groups of related policies (initiatives)

How can you detect threats in Azure Sentiel

build in analytics based on known threats and vectors using customizable templates or build custom analytics with specific rules for your environment

Azure IoT Central

builds on top of IoT Hub by adding a prebuilt customizable dashboard that allows you to view, connect, monitor, and manage your IoT devices You can also set up alerts to send messages when a certain device needs maintenance

A VM in Azure can connect to the internet by default, but how can you enable incoming connections?

by defining a public IP address or a public load balancer

How do you build a Logic App

by linking triggers to actions (a task or step that can execute) with connectors

Azure Repos

centralized source-code repository where software development, DevOps engineering, and documentation professionals can publish their code for review and collaboration.

How can you cutover from your on-premises SQL Server to your Azure SQL Managed Instance

changing the connection string in your applications

Sore application or backup data safely and securely using

cloud based storage in Azure

a way to rent compute power and storage from someone else's datacenter

cloud computing

The United Kingdom (UK) Government G-Cloud is a

cloud computing certification for services used by government entities in the United Kingdom. Azure has received official accreditation from the UK government.

You can use availability zones to run mission-critical applications and build high-availability into your application architecture by

co-locating your compute, storage, networking, and data resources within a zone and replicating in other zones

What are blueprint artifacts?

components in a blueprint definition

you can use these cloud services to help scale computing capabilities on demand while only paying for what you use using this service category

compute services

File integrity monitoring

configure the monitoring of changes to important files on both Windows and Linux, registry settings, applications, and other aspects that might indicate a security attack.

What is Azure Marketplace?

connect users with Microsoft partners, independent software vendors, and startups that are offering their solutions and services, which are optimized and certified to run on Azure. Includes open-source container platforms, virtual machine images, databases, application build and deployment software, developer tools, threat detection, and blockchain

assume that you have a private datacenter in California connected to ExpressRoute in Silicon Valley. You have another private datacenter in Texas connected to ExpressRoute in Dallas. With ExpressRoute Global Reach, you can

connect your private datacenters through two ExpressRoute circuits. Your cross-datacenter traffic will travel through the Microsoft network.

Logic Apps excel at

connecting a large array of disparate services via their APIs to pass and process data through many steps in a workflow you supply only a few details and the details of calling the necessary APIs is abstracted away

Defining your strategy with the Cloud Adoption Framework

consider why you're migrating to the cloud, what business outcomes you expect, and what project to lead with 1. define and document motivations by meeting with stakeholders and leadership 2. document business outcomes like finance, marketing, sales, human resources to write goals 3. evaluation financial considerations by measuring objectives and identifying the return expected 4. understand technical considerations for your first proj

Microsoft offers customers European Union (EU) Standard Contractual Clauses that provide

contractual guarantees around transfers of personal data outside of the EU

Adaptive application controls

control which applications are allowed to run on VMs. Security Center uses machine learning to look at the processes running on a VM and creates rules for each resource group that holds the VMs and provides recommendations and alerts that inform the company about unauthorized applications that are running on its VMs.

Defense in depth: data

controls access to business and customer data that you need to protect ensure the confidentiality, integrity, and availability of the data - follow regulatory requirements

Data in this access tier can tolerate slightly lower availability, but still requires high durability, retrieval latency, and throughput characteristics. This has a slightly lower availability service-level agreement (SLA) and higher access costs than other options.

cool access tier

At any time, you can check the ______________ page in the Azure portal to get a summary of your current usage and review invoices from prior months

cost management and billing

Readying your organization with the Cloud Adoption Framework

create a landing zone environment in azure to structure subscriptions, shared resources, tools, governance, security 1. Azure setup guide: review it and know stuff 2. Azure landing zone: build subscriptions 3. Expand landing zone: ensure it meets operations, governance, and security needs 4. best practices: follow recommended and proven practices to stay scalable and maintainable

Each time the Logic App trigger fires, the Logic Apps engine

creates a logic app instance that runs the actions in the workflow. These actions can also include data conversions and flow controls, such as conditional statements, switch statements, loops, and branching.

Azure agreements and contracts in China are signed by

customers and 21Vianet

security posture

cybersecurity policies and controls, as well as how well you can predict, prevent, and respond to security threats.

Usage patterns

define when and how users access your application consider if availability changes during critical and non-critical periods

service lifecycle

defines how every Azure service is released for public use 1. development phase -- collect & define requirements + build it 2. public preview phase -- public can access/experiment with it, provide feedback 3. general availability -- production ready service after testing and validation

application SLA

defines the SLA requirements for a specific application - typically one you build on Azure

What is meant by cloud computing?

delivery of computing services over the internet

Azure Resource Manager

deployment and management service for Azure to create, update, and delete resources, access control, locks, and tags to secure and organize your resources

Imperative code

details each individual step that should be performed to achieve a desired outcome

declarative code

details only a desired outcome, and it allows an interpreter to decide how to best achieve that outcome possibly more robust for deploying 100s of resources simultaneously and reliably

Azure Functions can perform orchestration tasks by using an extension called Durable Functions, which allow

developers to chain functions together while maintaining state.

IoT Hub monitoring helps you maintain the health of your solution by tracking events such as

device creation, device failures, and device connections.

By taking advantage of cloud-based backup services, data replication, and geo-distribution, you can deploy your apps with the confidence that comes from knowing that your data is safe in the event of disaster. This is called

disaster recovery

Disk Storage provides

disks for Azure virtual machines. Applications and other services can access and use these disks as needed allowing persistently stored and accessed data

What are DDoS attacks?

distributed denial of service attack attempts to overwhelm and exhaust an application's resources, making the application slow or unresponsive to legitimate users. can target anything publicly reachable through the internet

One advantage of blob storage over disk storage is that it

does not require developers to think about or manage disks; data is uploaded as blobs, and Azure takes care of the physical storage needs.

Event-driven scale in Serverless computing

e.g. if you need to response to events like timers, http/api/webhooks, queues, etc. The platform automatically schedules the function to run and scales the number of compute instances based on the rate of incoming events. Triggers define how a function is invoked. Bindings provide a declarative way to connect to services from within the code.

Pros of microservices

each service can be created with a different tech stack so each job can be completed with the best tools for that service easier for new team members to ramp up and get started bc each service has a small scope to pick up can update and deploy single service at a time bugs and features = more manageable and less risky a service can go down without taking out entire app good for high release velocity; highly scalable, good if app has many domains/subdomains; good for small development teams

Before you jump in to build a custom chat experience by using Bot Service, it might make sense to

earch for prebuilt, no-code solutions that cover common scenarios e.g. QnA Maker on Azure Marketplace that uses FAQ/support/manuals etc to build a bot

You can configure cloud-based apps to take advantage of autoscaling, so your apps always have the resources they need. This is considered

elasticity

Azure virtual networks

enable Azure resources, such as VMs, web apps, and databases, to securely communicate with each other, with users on the internet, and with your on-premises client computers. You can think of an Azure network as a set of resources that links other Azure resources.

Azure Databse for MySQL and Azure Databse for MariaDB

enable you to deliver highly-available, scalable apps with managed open-source database services. You can also migrate your existing MySQL and MariaDB workloads to the cloud.

Azure Batch

enables large-scale parallel and high-performance computing (HPC) batch jobs with the ability to scale to tens, hundreds, or thousands of VMs.

GitHub Actions

enables workflow automation with triggers for many lifecycle events like CI/CD toolchain

App Service

enables you to build and host web apps, background jobs, mobile back-ends, and RESTful APIs in the programming language of your choice without managing infrastructure. It offers automatic scaling and high availability. Supports automated deployments for Continuous deployment

Azure Blueprints

enables you to define a repeatable set of standard Azure resources that your organization requires e.g. define that a certain resource lock must exist --> if the lock is removed it will be replaced

network security group

enables you to filter network traffic to and from Azure resources within an Azure virtual network like an internal firewall can contain multiple inbound and outbound security rules that enable you to filter traffic to and from resources by source and destination IP address, port, and protocol

Azure SQL Managed Instance

enables you to migrate your SQL workloads to Azure while maintaining complete SQL server compatibility. With SQL Server on Azure VMs, you can also migrate your SQL workloads to Azure while maintaining OS-level access

for a VPN gateway you need to deploy a virtual network with

enough address space for the additional subnet that you'll need for the VPN gateway. The address space for this virtual network must not overlap with the on-premises network that you'll be connecting to. You can deploy only one VPN gateway within a virtual network.

Defense in depth: identity and access

ensuring that identities are secure, access is granted only to what's needed, and sign-in events and changes are logged controls access to infrastructure and change control Use single sign-on (SSO) and multifactor authentication MFA audit events and changes

Define your workloads with the TCO Calculator

enter the specifications of your on-premises infrastructure - servers: OS, virtualization, CPI cores, RAM memory - databases: types, hardware, Azure service replacement - Storage: type and capacity, archive storage - networking: bandwidth you currently consume etc

Authentication

establishing the identity of a person or service that wants to access a resource - get legit creds, confirm user is who they say they are

Authorization

establishing what level of access an authenticated person or service has - what data they're allowed to access and what they can do with it

Azure Advisor

evaluates configuration and usage Azure resources and makes recommendations to help improve reliability, security, and performance, achieve operational excellence, and reduce costs designed to help you save time on cloud optimization recommendation service includes suggested actions you can take right away, postpone, or dismiss

When you assign the Owner role to a user at the management group scope, that user can manage

everything in all subscriptions within the management group.

You can enable ExpressRoute Global Reach to

exchange data across your on-premises sites by connecting your ExpressRoute circuits

Azure CLI

executable program that can execute commands in Bash that call the Azure Rest API to perform any mgmt task in Azure used for routine setup, teardown, and maintenance of resources or the deployment

Policy definition

expresses what to evaluate and what action to take e.g. prevent VMs from being deployed in certain Azure regions Every policy definition has conditions under which it's enforced and an accompanying effect that takes place when the conditions are met

tags provide

extra info (metadata) about your resources

T/F A private cloud is always on prem

false - it can be hosted by a third party. Private just means only you can access and use it

Cloud computing offers

faster innovation, flexible resources, and economies of scale.

How can you request a service credit from Microsoft?

file a claim within the timeline your SLA states (typically 1-2 months: end of calendar month after the month the incident occurred in)

Defense in depth: physical security

first line of defense to protect computing hardware in the datacenter access to buildings and computing hardware

99.99 percent uptime is called

four-nines

When can you use spending limits to prevent accidental overun?

free or credit-based subscriptions when you run out of credits, deployed resources are removed rom production and VMs are stopped and deallocated - your data becomes read-only for credit-based subscriptions, your subscription is suspended until the next billing period

Azure Cost Management + Billing

free service that helps you understand your Azure bill, manage your account and subscriptions, monitor and control Azure spending, and optimize resource use

Azure file storage

fully managed file shares in the cloud accessibly with industry standard network protocols (Server Message Block and Network File System (preview) protocols)

Azure db offerings include

fully managed relational and in-memory databases spanning proprietary and open source engines

Azure HDInsight

fully managed, open-source analytics service for enterprises that processes massive amounts of data with clusters types like Apache Spark, Hadoop, Kafka, HBase, and Storm in the cloud. also supports a broad range of scenarios such as extraction, transformation, and loading (ETL), data warehousing, machine learning, and IoT.

Data Protection Addendum DPA

further defines the data processing and security terms for online services including - Compliance with laws - Disclosure of data - Data Security practices and policies: data encryption, data access, customer responsibilities, compliance with auditing - Data transfer, retention, and deletion

Why are regions important?

give you the flexibility to bring applications closer to your users no matter where they are. Global regions provide better scalability and redundancy. They also preserve data residency for your services.

How can you access DPA (Data protection addendum)

go to licensing resources and documents on micrsoft.com search for DPA

security controls

groups of related security recommendations

Capital Expenditure (CapEx)

he up-front spending of money on physical infrastructure, and then deducting that up-front expense over time. The up-front cost from CapEx has a value that reduces over time.

Azure Pricing Calculator

help determine which Azure service best fit your budget with estimations of resources and their configurations

Azure Databricks

helps unlock insights from all your data and build artificial intelligence solutions using an interactive Apache Spark-based analytics service with other big data services in Azure. supports Python, Scala, R, Java, and SQL, as well as data science frameworks and libraries including TensorFlow, PyTorch, and scikit-learn.

Cloud Adoption Framework for Azure

helps you create and implement the business and technology strategies needed to succeed in the cloud by providing you with proven guidance to help with your cloud adoption journey

Azure Blob Storage is unstructured, meaning that

here are no restrictions on the kinds of data it can hold

Depending on the service-level agreement (SLA) that you choose, your cloud-based apps can provide a continuous user experience with no apparent downtime, even when things go wrong. This is considered

high availability

Advantages of using cloud

high availability; scalability; elasticity; agility; geo-distribution; disaster recovery

Azure Database for PostgreSQL Hyperscale (Citus)

horizontally scales queries across multiple machines by using sharding. Its query engine parallelizes incoming SQL queries across these servers for faster responses on large datasets. It serves applications that require greater scale and performance, generally workloads that are approaching, or already exceed, 100 GB of data. It supports multi-tenant applications, real-time operational analytics, and high throughput transactional workloads. Apps for PostgreSQL can run distributed queries on Hyperscale (Citus) with standard connection libraries and minimal changes.

What access tiers for blob storage can be set at the blob level, during upload or after upload?

hot, cool, or archive

App Service plans determine

how much hardware is devoted to your host. For example, the plan determines whether it's dedicated or shared hardware and how much memory is reserved for it.

The main difference between policy-based and route-based VPNs is

how traffic to be encrypted is specified

Which cloud model (private, public, hybrid) is more flexible?

hybrid

This layer is now more often the target of attack than the network is.

identity layer

What happens if a pod crashed or is removed in kubernetes

if a pod crashed a new instance can be created if a pod is removed, the workload can be moved to a different pod in the cluster

When to use route based VPN gateways

if you need - Connections between virtual networks - Point-to-site connections - Multisite connections - Coexistence with an Azure ExpressRoute gateway

When is Conditional Access useful?

if you need to - require MFA - for certain users or networks, or all users/networks - require access only via approved apps (like only accessing outlook via the outlook app) - require access only via managed devices (a device meeting your standard for security and compliance) - block access from untrusted sources (like unknown/unexpected locations)

What does it mean for inbound data traffic to be free but outbound to cost money?

inbound = data going into Azure datacenters outbound = data leaving Azure datacenters some inbound data stuff is free outbound data transfer pricing is based on billing zones

Who can you apply Azure RBAC to?

individuals, groups, service principals, and managed identities

code that performs setup and configuration can be stored, versioned, and maintained along with application source code in a source code-management tool such as Git. This approach to managing hardware and cloud resources, is referred to as

infrastructure as code

Why use initiatives even when you only have a single policy?

initiatives enable you to increase the number of policies apply to a scope over time w/o having to change the policy assignment for your resources

Resources

instances of services that you create, like virtual machines, storage, or SQL databases

Why care about SLAs?

it affects your performance and the SLA you can make with your customers

What does it mean for a firewall to be stateful

it analyzes the complete context of a network connection, not just an individual packet of network traffic

Describe the relationship between the blueprint definition (what should be deployed) and the blueprint assignment (what was deployed)

it is preserved - Azure creates a record that associates a resource with the blueprint that defines it so you can track and audit deployment

How does Azure Firewall enables outside firewalls to identify traffic coming from your virtual network

it uses a static (unchanging) public IP address for your virtual network resources

combines container management automation with an extensible API to create a cloud native application management powerhouse

kubernetes

Virtual machine scale sets

let you create and manage a group of identical, load-balanced VMs

Conditional Access comes with a What If tool, which

lets you test our Conditional Access policies before you implement them by modeling your proposed Conditional Access policies across recent sign-in attempts from your users to see what the impact would have been if those policies had been enabled.

What is it called when you move from a physical server to the cloud

lift and shift

How do you assign Azure Policy Initiatives?

like policy assignment, just assign it a specific scope of a management group, subscription, or resource group

Which is not a feature of cloud computing? - faster innovation - limited pool of services - speech recognition and other cognitive services

limited pool of services is not a feature of cloud computing

Defense in depth: network

limits communication between resources through segmentation and access controls to allow only what is required restrict inbound internet access and limit outbound where appropriate Implement secure connectivity to on-premises networks

resource quotas

limits on the number of similar resources you can provision in a subscription -- mostly so Microsoft can plan its datacenter copacity

Azure Logic Apps

low/no code development platform using Logic Apps Designer UI to help automate and orchestrate tasks based on event triggers Build by linking triggers to actions using a library of connectors (or a custom connector)

Azure IoT Hub

managed service that's hosted in the cloud and that acts as a central message hub for bi-directional communication between your IoT application and the (maybe millions) devices it manages.

What can be used to manage governance across multiple Azure subscriptions

management groups

You organize subscriptions into containers called

management groups

Making a plan with the Cloud Adoption Framework

map goals to specific actions 1. digital estate: identify existing workloads you want to migrate to the cloud 2. initial organization alignment: who needs to be involved (tech + governance) 3. skills readiness plan: how to train them to operate in the cloud 4. cloud adoption plan: to bring together the devlopment, operations, and business teams toward a shared goal

Containers are often used to create solutions that break solutions into smaller, independent pieces this is called

microservice achitecture

you might split a website into a container hosting your front end, another hosting your back end, and a third for storage. This split allows you to separate portions of your app into logical sections that can be maintained, scaled, or updated independently. This is an example of?

microservice architecture

this is a way to simplify an application architecture by focusing on creating smaller, more manageable, autonomous, and independently deployed web services that address a single business domain or capability

microservice architectures

Adopting the cloud MIGRATION with the Cloud Adoption Framework

migrate your first workload using migration guide, and innovate stuff 1. migrate your first workload 2. migration scenarios: use additional in-depth guides to explore complex migrations 3. best practices: check Azure cloud migration best practice checklist to verify you've got them 4. process improvements: find ways to make migration process scale with less effort + innovate

Azure SQL Database and Azure SQL Managed Instance offer many of the same features; however, Azure SQL Managed Instance provides several options that might not be available to Azure SQL Database. These include

migrating dbs to the cloud that do not use SQL_Latin1_General_CP1_CI_AS server collation (the only one SQL Database supports)

you can build and deploy cross platform and native apps for any mobile device, use Xamarin services in Azure using this service category

mobile

As you move your workloads to the cloud, a natural evolution is to start with infrastructure as a service (IaaS) services because they map more directly to concepts and operations you're already familiar with. But to save costs you can

move from IaaS to PaaS which are less expensive and require less to manage but can still meet your requirements

UDR (user defined routing) is a significant update to Azure's Virtual Networks as this allows

network admins to control the routing tables between subnets within a VNet, as well as between VNets, thereby allowing for greater control over network traffic flow.

These have security rules that enable you to filter the type of network traffic that can flow in and out of virtual network subnets and network interfaces. After it is created it is associated with a VNet What is it?

network security group

What is like an internal firewall (firewall but within the same network)

network security group

Connect virtual networks to other virtual networks through a _____________ connection

network-to-network

for a VPN gateway you need to create a Virtual network gateway, explain

o route traffic between the virtual network and the on-premises datacenter or other virtual networks. The virtual network gateway can be either a VPN or ExpressRoute gateway

Azure blob storage

object storage solution for massive amounts of unstructured data like text and binary good for serving images and documents directly to a browser; storing archive data; steaming video and audio; disaster recovery

Azure Reservations

offers discounted prices on certain Azure services by reserving services and resources by paying in advance save you up to 72 percent as compared to pay-as-you-go prices

Azure Container Instances

offers the fastest and simplest way to run a container in Azure without having to manage any virtual machines or adopt any additional services. Containerized apps run on Azure without provisioning servers or VMs.

How is Azure RBAC enforced?

on any action that's initiated against an Azure resource that passes through Azure Resource Manager

Managing your cloud environments with the Cloud Adoption Framework

ongoing work for your cloud environment 1. establish a mgmt baseline: define minimum set of tools that should be applied to every asset in the environment - your commitment to operations 2. define business commitments: document supported workloads and operations and agree on cloud investments 3. expand the management baseline: apply recommended best practices to iterate on your initial management baseline 4. advanced operations and design principles: perform a deeper architecture review to deliver on your resiliency and reliability

Governing your cloud environments with the Cloud Adoption Framework

ongoing work for your cloud environment 1. methodology: consider end goal - how can you get there in steps 2. benchmark: use the governance benchmark tool to assess your current and future states to establish a vision 3. initial governance foundation: create an MVP capturing the first steps of your governance plan 4. improve the initial governance foundation: iteratively add governance controls that address tangible risks as you progress toward your final goal

What access tiers can be set at the account level?

only hot and cool (not archive)

Azure Government uses physically isolated datacenters and networks located

only in the US

The task of automating, managing, and interacting with a large number of containers is known as

orchestration

If you have multiple departments and need to do a "chargeback" of cloud costs by department you can

organize subscription by department or project or use tags

Bot Service solutions usually rely on

other AI services for such things as natural language understanding or even translation for localizing replies into a customer's preferred language

You can link virtual networks together by using virtual network

peering

DevOps is a concept that combines

philosophies and practices to facilitate technical teams as they work toward common goals by employing processes that automate the ongoing development, maintenance, and deployment of software systems to expedite the release of software changes, ensure the ongoing deploy-ability of the system, and ensure that all changes meet a high quality bar.

US DoD Central, US Gov Virginia, US Gov Iowa are regions that are

physical and logical network-isolated instances of Azure for U.S. government agencies and partners. These datacenters are operated by screened U.S. personnel and include additional compliance certifications.

Availability zone

physically separate datacenters within an Azure region

When done correctly, DevOps practices and processes touch nearly every aspect of a company and the software development lifecycle, including

planning, project management, and the collaboration of software developers and operations and quality assurance teams. Tooling automates and enforces most of the practices and processes, making it both difficult and unnecessary to work around.

Azure Bot Service & Bot Framework

platforms for creating virtual agents that understand and reply to questions just like a human; it creates a virtual agent that can intelligently communicate with humans. can include ordering food by text, simple QA, or sophisticated convo that provides access to services

Connect individual devices to virtual networks through a ____________ connection

point-to-site

compliance blueprints on policy definitions, for common standards

policy definitions for common security standards that you can apply to your Azure subscription helps make sure you meet standards

resource lock

prevent resources from being accidently deleted or changed

What is Azure

private and public cloud platform with an ever-expanding set of services to help you build solutions to meet your business goals. Azure services range from simple web services for hosting your business presence in the cloud to running fully virtualized computers for you to run your custom software solutions. Azure provides a wealth of cloud-based services like remote storage, database hosting, and centralized account management. Azure also offers new capabilities like AI and Internet of Things (IoT).

Multifactor authentication

process where a user is prompted during the sign-in process for an additional form of identification. Examples include a code on their mobile phone or a fingerprint scan. Makes it more difficult to fully authenticate and steal credentials

Defense in depth: perimeter

protecting from network-based attacks against your resources. Identifying these attacks, eliminating their impact, and alerting you when they happen are important ways to keep your network secure. uses distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users use perimeter firewalls to identify and alert on malicious attacks against your network.

Azure Dedicated Host

provides dedicated physical servers to host your Azure VMs for Windows and Linux (instead of shared hardware like normal VMs in Azure)

Azure Mobile App

provides iOS and Android access to your Azure resources when you're away from your computer You can - monitor health and status of resources - check alerts, diagnose and fix issues, restart a web app or VM, etc - run Azure CLI or PowerShell commands to manage resources

Azure Cognitive Services

provides prebuilt machine learning models that enable applications to see, hear, speak, understand, and even begin to reason.

Azure compliance documentation

provides you with detailed documentation about legal and regulatory standards and compliance on Azure.

How can you avoid defining role based access controls for multiple subscriptions that user should have access to?

put the subscriptions in a management group and apply the role based access control to the group

Regulatory compliance

refers to the discipline and process of ensuring that a company follows the laws that governing bodies enforce

tenant

representation of an organization (in Azure)

manageable item that's available through Azure. Virtual machines (VMs), storage accounts, web apps, databases, and virtual networks are examples of this

resource

A container that holds related resources for an Azure solution. This container includes resources that you want to manage as a group.

resource group

Before any resource can be provisioned, you need a

resource group for it to be placed in.

virtual network Peering enables

resources in each virtual network to communicate with each other. These virtual networks can be in separate regions, which allows you to create a global interconnected network through Azure.

When you assign the Contributor role to an application at the resource group scope, the application can manage

resources of all types within that resource group, but not other resource groups within the subscription.

ExpressRoute connectivity can be

rom an any-to-any (IP VPN) network, a point-to-point Ethernet network, or a virtual cross-connection through a connectivity provider at a colocation facility

this is automatically created for each subnet within an Azure vNet with default routes. You can add custom routes to modify traffic between virtual networks. This is?

route table

Azure Service Health

rovides a personalized view of the health of the Azure services, regions, and resources you rely on as well as incident history and root cause analysis

when you increase compute capacity by adding instances of resources, such as adding VMs to the configuration you are

scaling horizontally (scalability)

to increase compute capacity by adding RAM or CPUs to a single virtual machine you are

scaling vertically (scalability)

ARM Templates

scripts for deploying multiple servers that may need to connect to each other or be deployed in a certain order describe the resources you want to use in a declarative JSON format. The entire ARM template is verified before any code is executed to ensure that the resources will be created and connected correctly. You only need to define the desired state and configuration of each resource in the ARM template, and the template does the rest

What is your secure score based on?

security controls: he percentage of security controls that you satisfy

SIEM system

security information and event management aggregates security data from many different sources

define virtualization

separates the tight coupling of the computers hardware and OS using an abstraction layer called hypervisor which emulates the functioning of a real computer and its CPU in a VM optimizing the capacity of the hardware

a term used to describe an execution environment that's set up and managed for you. You merely specify what you want to happen by writing code or connecting and configuring components in a visual editor, and then specify the actions that trigger your functionality. You never have to worry about an outage, your code can scale instantly to meet demand, and you pay based only on the actual usage of your code.

serverless computing

a cloud-hosted execution environment that runs your code but abstracts the underlying hosting environment so that you're not responsible for setting up or maintaining the server. You don't have to worry about scaling it when there's increased demand, and you don't have to worry about outages. It is responsible for sending messages from one system to another, or processing messages that were sent from other systems. It's not used for user-facing systems but, rather, it works in the background.

serverless computing (Azure Functions or Logic Apps)

Trust Center

showcases Microsoft's principles for maintaining data integrity in the cloud and how Microsoft implements and supports security, privacy, compliance, and transparency in all Microsoft cloud products and services providing support and resources for the legal and compliance community on microsoft.com -- not in Azure!

How fast are Cosmos DB data accesses?

single-digit-millisecond data access

Connect on-premises datacenters to virtual networks through a __________ connection

site-to-site

Firewall rules can

specify ranges of IP addresses to allow, or include specific network protocol and port information

Key features of policy-based VPN gateways in Azure include

specify statically the IP address of packets that should be encrypted through each tunnel - Support for IKEv1 only - Use of static routing, where combinations of address prefixes from both networks control how traffic is encrypted and decrypted through the VPN tunnel - must be used in specific scenarios that require them, such as for compatibility with legacy on-premises VPN devices

Adjust assumptions with TCO calculator

specify whether your current on-premises licenses are enrolled for Software Assurance, which can save you money by reusing those licenses on Azure specify whether you need to replicate your storage to another Azure region for greater redundancy see the key operating cost assumptions across several different areas certified by Nucleus Research like electricity, IT admin costs, network maintenance etc. --- adjust these for your current costs

Operational Expenditure (OpEx)

spending money on services or products now, and being billed for them now. You can deduct this expense in the same year you spend it. There is no up-front cost, as you pay for a service or product as you use it.

Are Azure Functions stateless of stateful?

stateless by default - behaves as if it's restarted every time it responds to an event

SKU

stock-keeping unit

Azure disk storage

stores disks for VMs and apps to access and use as needed SSD (solid state drives for higher performance work loads) HDD (hard drive disk for less critical stuff)

a logical unit of Azure services that links to an Azure account,

subscription

Teams often start their Azure governance strategy at what level

subscription level

What is a logical unit of Azure services that links to an Azure account?

subscriptions

Azure DevOps

suit of services addressing every stage of development using tools like high-performance pipelines, free private Git repositories, configurable Kanban boards, and extensive automated and cloud-based load testing. Formerly known as Visual Studio Team Services. Good for sophisticated project management and reporting.

What helps organize existing resources and groups?

tags

IoT Central provides starter templates, explain

templates for retail, energy, healthcare, and government can be provided and customized in the UI and tailor to the specific data that's sent from your devices, the reports you want to see, and the alerts you want to send. You can use the UI to update or modify a device with little code required to get started bc of the templates

Azure Cognitive Services is general purpose, meaning

that many different kinds of customers can benefit from the work that Microsoft has already done to train and test these models and offer them inexpensively at scale.

How can you estimate total cost of Azure resources?

the Azure Pricing calculator displays Azure products in categories for you to configure and add to your estimate Then you get a total estimate and price breakdown

Serverless computing

the abstraction of servers, infrastructure, and operating systems Azure takes care of managing the server infrastructure and the allocation and deallocation of resources based on demand. Infrastructure isn't your responsibility. Scaling and performance are handled automatically. You're billed only for the exact resources you use.

How do you get billed for Azure Marketplace purchases?

the billing structures are set by the vendor of the thing you use

What is cloud computing

the delivery of computing services over the internet, which is otherwise known as the cloud. These services include servers, storage, databases, networking, software, analytics, and intelligence.

What if state is required in an Azure Function?

the function can be connected to an Azure storage account

what is responsible for handling everything that happens in Azure including responding to user requests

the orchestrator, a piece of software connected to a fabric controller a fabric controller is software located on a server on each rack in an azure datacenter e.g. user wants new VM, orchestrator gets everything needed and sends request to a fabric controller which creates the VM and lets the user know when its ready

An availability zone is set up to be an isolation boundary. If one zone goes down,

the other continues working. Availability zones are connected through high-speed, private fiber-optic networks.

service credit

the percentage of the fees you paid that are credited back to you according to the claim approval process.

Microsoft is the first cloud provider to have adopted the ISO/IEC 27018 code of practice, which covers

the processing of personal information by cloud service providers

When planned maintenance or unplanned disruption affects the active instance of a VPN Gateway

the standby instance automatically assumes responsibility for connections without any user intervention connections are restored restored within a few seconds for planned maintenance and within 90 seconds for unplanned disruptions

The primary difference between Azure PowerShell and Azure CLI is

the synax you use

Downtime

the time duration that the service is unavailable

Where can you apply locks?

to a subscription, resource group, or resource

for a VPN gateway you need to create a connection, explain

to create a logical connection between the VPN gateway and the local network gateway. The connection is made to the on-premises VPN device's IPv4 address as defined by the local network gateway. The connection is made from the virtual network gateway and its associated public IP address. You can create multiple connections.

for a VPN gateway you need to create a Local network gateway, explain

to define the on-premises network's configuration, such as where the VPN gateway will connect and what it will connect to. This configuration includes the on-premises VPN device's public IPv4 address and the on-premises routable networks. This information is used by the VPN gateway to route packets that are destined for on-premises networks through the IPSec tunnel.

The objective of defense in depth is

to protect information and prevent it from being stolen by those who aren't authorized to access it. A defense-in-depth strategy uses a series of mechanisms to slow the advance of an attack that aims at acquiring unauthorized access to data.

T/F You pay for the Azure compute resources your app uses while it processes requests based on the App Service plan you choose.

true

UDR

user-defined Routing

Azure routes traffic between subnets on any connected virtual networks, on-premises networks, and the internet. How can you override this?

using route tables (rules to direct packets) and border gateway protocol (works with Azure VPN gateways or ExpressRoute to handle routes)

Azure PowerShell

utilized Azure mgmt API to automate identical tasks like updating VMs with software patch - execute cmdlets that call the Azure Rest API to perform any mgmt task in Azure. - Cmdlets can be used for routine setup, teardown, and maintenance of resources or the deployment of an entire infrastructure from imperative code.

Azure Monitor

very comprehensive platform for collecting, analyzing, visualizing, and potentially taking action based on the metric and logging data from your entire Azure and on-premises environment helps identify and drill into the root cause of issues

How can you add, modify, or delete tags?

via powershell, azure cli, ARM templates, the REST API, or Azure Portal You can also use Azure Policy

When you assign the Reader role to a group at the subscription scope, the members of that group can

view every resource group and resource within the subscription.

it's easier to build large-scale services targeting big compute, big data, and containerized workloads. As demand goes up, more VM instances can be added. As demand goes down, VM instances can be removed. The process can be manual, automated, or a combination of both. What am I?

virtual machine scale set

Which Azure compute resource can be deployed to manage a set of identical virtual machines?

virtual machine scale sets

What can you use to link virtual networks?

virtual network peering

National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) is a

voluntary framework that consists of standards, guidelines, and best practices to manage cybersecurity-related risks

How does Azure Active Directory enforce MFA

w/ Microsoft Authenticator app; SMS code, or phone call

microservice (define and pros)

web service with a small well defined scope and is loosely couple from any other web service typically create multiple to work together via APIs or parent app and each have a single functionality each service should be completely autonomous with no dependencies on other services

Adopting the cloud INNOVATION with the Cloud Adoption Framework

while migrating to the cloud, you may find ways to innovate 1. business value consensus: verify your changes add value and meet customer needs 2. azure innovation guide: use this to accelerate development and build a MVP for your idea 3. best practices: verify your progress maps to recommended practice before continuing 4. feedback loops: check with customers often to verify you're meeting their needs

logic apps execute

workflows that are designed to automate business scenarios and are built from predefined logic blocks.

Examples of actions in Logic Apps include

working with variables, decision statements and loops, and tasks that parse and modify data

in an active/active configuration

you assign a unique public IP address to each instance. You then create separate tunnels from the on-premises device to each IP address

One thing that distinguishes Azure Files from files on a corporate file share is that

you can access the files from anywhere in the world, by using a URL that points to the file. You can also use Shared Access Signature (SAS) tokens to allow access to a private asset for a specific amount of time.

After a dedicated host is provisioned, Azure assigns it to the physical server in Microsoft's cloud datacenter. What can you do for high availability?

you can provision multiple hosts in a host group (collection of dedicated hosts), and deploy your VMs across this group also take advantage of maintenance control to control when regular maintenance updates occur

ExpressRoute provides Layer 3 (address-level) connectivity between

your on-premises network and the Microsoft cloud through connectivity partners. These connections can be from a point-to-point or any-to-any network. They can also be virtual cross-connections through an exchange.