DevOps Microsoft Azure Syllabus

What is the difference between AKS and Azure Container Instances (ACI)?

AKS provides full Kubernetes orchestration for complex, scalable multi-container workloads. ACI runs single containers quickly without orchestration—best for simple, short-lived, or burst tasks. AKS can burst to ACI via virtual nodes.

What is Azure Blob Storage?

A massively scalable object storage service for unstructured data (images, video, logs, backups, documents). Data is stored as blobs inside containers within a storage account, accessible over HTTP/HTTPS and REST.

What are the three types of blobs in Azure Blob Storage?

Block blobs (text/binary files, optimized for large uploads), Append blobs (optimized for append operations like logging), and Page blobs (random read/write, used for VHD disks of Azure VMs).

What are the Azure Blob Storage access tiers?

Hot (frequent access, highest storage cost, lowest access cost), Cool (infrequent access, ~30-day minimum), Cold (rarely accessed, ~90-day minimum), and Archive (offline, lowest storage cost, highest retrieval cost/latency).

What is Azure Files (Azure File Storage)?

A fully managed file share service in the cloud accessible via the SMB and NFS protocols (and REST). Shares can be mounted concurrently by cloud or on-premises Windows, Linux, and macOS clients.

What is Azure File Sync?

A service that synchronizes on-premises Windows file servers with an Azure file share, enabling cloud tiering (keeping hot files local while moving cold files to Azure) so the server acts as a fast local cache.

What is Azure Disk Storage (Managed Disks)?

Block-level storage volumes managed by Azure and attached to virtual machines, acting as physical disks. Azure handles the storage account management, availability, and scalability of the disks.

List the Azure Managed Disk performance tiers from highest to standard performance.

Ultra Disk (highest IOPS/throughput, mission-critical), Premium SSD v2 / Premium SSD (production, low latency), Standard SSD (web servers, light workloads), and Standard HDD (backup, infrequent access, lowest cost).

Distinguish Blob Storage, Azure Files, and Disk Storage by use case.

Blob = unstructured object storage for apps/backups. Files = shared file system accessed via SMB/NFS by multiple clients. Disk = block storage attached to a single VM as its drive. They serve object, file-share, and block scenarios respectively.

What is an Azure Virtual Network (VNet)?

A logically isolated, private network in Azure that lets your resources (VMs, etc.) securely communicate with each other, the internet, and on-premises networks. It is scoped to a single region and subscription and is divided into subnets.

What is a subnet in an Azure VNet, and how is its address space defined?

A subnet is a sub-range of a VNet's IP address space (defined in CIDR notation, e.g. $10.0.1.0/24$) used to segment the network and apply policies. Resources are deployed into specific subnets.

What is VNet peering?

A mechanism that connects two Azure virtual networks so traffic routes privately through Microsoft's backbone (not the public internet). It can be regional (same region) or global (across regions); peering is non-transitive by default.

What is a Network Security Group (NSG)?

A set of prioritized inbound and outbound security rules (allow/deny by source/destination IP, port, and protocol) that filter network traffic to and from Azure resources within a VNet, attached to subnets or NICs.

What is Azure Load Balancer?

A Layer 4 (TCP/UDP) load balancer that distributes inbound network traffic across a backend pool of healthy VMs to provide high availability and scalability, using health probes and load-balancing rules.

What is the difference between a public and an internal Azure Load Balancer?

A public (external) Load Balancer has a public IP and balances internet traffic to backend VMs. An internal (private) Load Balancer uses a private IP and balances traffic only within a VNet (e.g., a tiered/internal application).

How does Azure Load Balancer differ from Azure Application Gateway?

Load Balancer operates at Layer 4 (transport, TCP/UDP). Application Gateway operates at Layer 7 (HTTP/HTTPS), offering URL path-based routing, SSL termination, cookie-based session affinity, and a Web Application Firewall (WAF).

What is the role of a health probe in Azure Load Balancer?

It periodically tests backend instances; only instances that respond as healthy receive traffic. Unhealthy instances are removed from rotation until they pass the probe again, ensuring traffic goes only to working endpoints.

What is Azure VPN Gateway?

A specific type of virtual network gateway that sends encrypted traffic between an Azure VNet and on-premises locations (site-to-site) or individual clients (point-to-site) over the public internet using IPsec/IKE tunnels.

Compare Site-to-Site, Point-to-Site, and VNet-to-VNet VPN connections.

Site-to-Site connects an on-premises network to a VNet via IPsec over the internet. Point-to-Site connects an individual client device to a VNet. VNet-to-VNet connects two Azure VNets through their VPN gateways.

How does Azure VPN Gateway differ from Azure ExpressRoute?

VPN Gateway sends encrypted traffic over the public internet (lower cost, variable performance). ExpressRoute provides a private, dedicated connection through a connectivity provider, bypassing the internet for higher bandwidth, lower latency, and reliability.

What is Azure SQL Database?

A fully managed PaaS relational database based on the latest stable Microsoft SQL Server engine, with automated patching, backups, high availability, and scaling, so you do not manage the OS or SQL Server installation.

What are the purchasing/deployment models for Azure SQL Database?

Deployment options: Single database, Elastic pool (shared resources across databases), and Managed Instance. Purchasing models: DTU-based (bundled compute/storage/IO) and vCore-based (independently chosen compute and storage).

What is a DTU in Azure SQL Database?

A Database Transaction Unit—a blended measure of compute (CPU), memory, and I/O resources. Higher DTU tiers give more performance; it bundles these resources into preconfigured service levels (Basic, Standard, Premium).

What is Azure Cosmos DB?

A globally distributed, multi-model NoSQL (and relational via PostgreSQL API) database service offering turnkey global distribution, elastic scaling of throughput/storage, and single-digit-millisecond latency with comprehensive SLAs.

Name the API models supported by Azure Cosmos DB.

NoSQL (Core/SQL), MongoDB, Apache Cassandra, Apache Gremlin (graph), Table, and PostgreSQL. The API determines the data model and query language used to interact with the data.

What are the five consistency levels in Azure Cosmos DB?

From strongest to weakest: Strong, Bounded Staleness, Session, Consistent Prefix, and Eventual. They trade off consistency against latency and availability—Strong gives linearizable reads; Eventual gives the lowest latency.

What is a Request Unit (RU) in Azure Cosmos DB?

The normalized currency for throughput, abstracting the CPU, memory, and IOPS needed for operations. Throughput is provisioned in RU/s; for example a point read of a 1 KB item costs $1$ RU.

What is Azure Database for MySQL/PostgreSQL?

Fully managed PaaS offerings of the open-source MySQL and PostgreSQL community database engines on Azure, providing automated patching, backups, high availability, and scaling while remaining compatible with existing open-source tools and apps.

What is the recommended deployment model for Azure Database for MySQL/PostgreSQL, and why?

The Flexible Server deployment model. It gives more granular control and flexibility over database configuration, maintenance windows, zone-redundant high availability, and cost optimization (including stop/start) compared to the older Single Server model.

What is Microsoft Entra ID (formerly Azure Active Directory)?

A cloud-based identity and access management (IAM) service that handles authentication and authorization, providing single sign-on (SSO), multi-factor authentication (MFA), and conditional access for users to Azure, Microsoft 365, and other apps.

How does Azure AD (Entra ID) differ from on-premises Active Directory Domain Services (AD DS)?

Azure AD is a cloud, internet-based identity provider using protocols like OAuth 2.0, OpenID Connect, and SAML for web/app SSO. On-prem AD DS is a hierarchical, domain-based directory using Kerberos/LDAP for managing devices and users on a corporate network.

What is Azure Role-Based Access Control (RBAC) and its three core elements?

RBAC authorizes access to Azure resources via role assignments. Each assignment combines a security principal (user/group/service principal), a role definition (set of permissions like Reader, Contributor, Owner), and a scope (management group, subscription, resource group, or resource).

What is Conditional Access in Microsoft Entra ID?

A policy engine that enforces access controls based on signals (user, device, location, risk). It applies if-then rules—for example, requiring MFA or a compliant device when a sign-in comes from an untrusted location—to balance security and usability.