Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Azure Management, Governance, Pricing and Trust (AZ-900) Syllabus

At which scopes can resource locks be applied, and how do they inherit?

Locks can be applied at the subscription, resource group, or individual resource level, and they are inherited by all child/contained resources.

What are tags in Azure and what are they used for?

Tags are name/value metadata pairs applied to resources, resource groups and subscriptions, used to organise resources and to enable logical grouping for billing, cost reporting, automation and management.

Give an example use of resource tags for cost management.

Tagging resources with a department or cost-centre value (e.g. "Department: Finance") so that Cost Management can group and report spend by that department for chargeback/showback.

What is Azure Service Health?

A personalised dashboard service that provides alerts and guidance about Azure service issues, planned maintenance, and health advisories that may affect your specific resources.

What are the three components of Azure Service Health?

Azure Status (global view of all Azure services worldwide), Service Health (personalised view of issues affecting the services/regions you use), and Resource Health (health of your individual resource instances).

What is the difference between Azure Status and Service Health?

Azure Status is a public, global view of outages affecting all customers; Service Health is a personalised view filtered to only the services, regions and subscriptions that you actually use.

What does Azure Resource Health report?

The current and historical health status of a specific resource instance (e.g. a particular VM), helping you determine whether an issue is caused by a platform event or your own configuration.

What is Azure Monitor?

A comprehensive monitoring solution that collects, analyses and acts on telemetry (metrics and logs) from Azure, on-premises and other cloud environments to maximise availability and performance.

What are the two fundamental types of data collected by Azure Monitor?

Metrics (numerical values describing a system aspect at a point in time) and Logs (event records and trace data queried with Kusto Query Language in Log Analytics).

What is Log Analytics within Azure Monitor?

A tool used to write and run queries (using Kusto Query Language, KQL) against log data collected by Azure Monitor to analyse and visualise it.

What is Application Insights?

A feature of Azure Monitor that provides application performance management (APM) by monitoring live web applications for availability, performance, usage and failures/exceptions.

What is the role of Azure Monitor alerts?

Alerts proactively notify you (or trigger automated actions) when a defined metric threshold is crossed or a specific log/event condition occurs, using action groups to deliver notifications.

What is a Service Level Agreement (SLA) in Azure?

A formal Microsoft commitment describing the guaranteed performance and uptime (availability) standards for an Azure service, including the service credits owed if those targets are not met.

How is the composite SLA of a multi-service application calculated?

By multiplying the SLA percentages of each component in the critical path: $$\text{Composite SLA} = \text{SLA}_{1} \times \text{SLA}_{2} \times \dots \times \text{SLA}_{n}$$ which yields a lower combined availability than any single component.

If a web app (99.95%) depends on a database (99.99%) in series, what is the approximate composite SLA?

$$0.9995 \times 0.9999 \approx 0.9994 = 99.94\%$$ — lower than either individual component.

How can adding redundant components in parallel affect the effective SLA?

Running independent instances in parallel increases availability because the combined chance of all failing is the product of their failure probabilities: $$\text{SLA}_{\text{parallel}} = 1 - (1 - \text{SLA})^{n}$$ for $n$ identical instances.

Do free Azure services (e.g. free-tier products) come with a financially backed SLA?

No. Free and preview-tier Azure services generally do not include a financially backed SLA; SLAs apply to paid, generally available services.

What downtime per month does an SLA of 99.9% ("three nines") roughly permit?

About 43.2 minutes per month (and roughly 8.76 hours per year).

What downtime per year does an SLA of 99.99% ("four nines") roughly permit?

About 52.6 minutes per year (roughly 4.38 minutes per month).

What is the Azure portal?

A web-based, unified graphical console (GUI) for building, managing and monitoring Azure resources, from simple web apps to complex deployments, using a browser without command-line tools.

What is Azure Cloud Shell?

A browser-based, authenticated, interactive command-line shell hosted in Azure, available in Bash or PowerShell modes, with common Azure tools pre-installed and no local setup required.

Which two shell experiences can you choose between in Azure Cloud Shell?

Bash (Linux-style, used with the Azure CLI) and PowerShell (used with Azure PowerShell / Az module).

What is the Azure CLI?

A cross-platform command-line tool (using commands beginning with "az") for creating and managing Azure resources, scriptable in Bash and other shells on Windows, macOS and Linux.

What is Azure PowerShell?

A set of cmdlets (the Az module) for managing Azure resources directly from the PowerShell command line, available cross-platform and in Cloud Shell.

When might you choose an Azure SDK over the CLI or portal?

When you need to manage or integrate Azure resources programmatically from within application code, using a preferred language such as .NET, Python, Java, JavaScript or Go.

What is Infrastructure as Code (IaC)?

The practice of defining and provisioning infrastructure through machine-readable definition/configuration files rather than manual processes, enabling consistent, repeatable and version-controlled deployments.

What is an Azure Resource Manager (ARM) template?

A JSON file that declaratively defines the infrastructure and configuration for an Azure deployment, enabling repeatable, idempotent deployment of resources as a single coordinated operation.

What is Bicep and how does it relate to ARM templates?

Bicep is a domain-specific declarative language that offers simpler, more concise syntax than JSON ARM templates; Bicep files transpile down to ARM templates for deployment.

What does it mean that ARM/Bicep deployments are declarative and idempotent?

Declarative: you state the desired end state, not the steps to get there. Idempotent: deploying the same template repeatedly produces the same result without creating duplicates or unintended changes.

How does Infrastructure as Code differ from manually deploying resources via the Azure portal?

IaC uses version-controlled definition files for automated, consistent, repeatable deployments at scale, reducing human error and configuration drift, whereas portal deployment is manual, slower and harder to reproduce exactly.

Which Azure governance tool would you use to automatically ensure all resources are deployed only to approved regions?

Azure Policy — you assign a policy (e.g. "Allowed locations") that denies the creation of resources in any region outside the approved list.