Microsoft Azure Certifications (e.g. AZ-104, AZ-900) Core Azure Services and Workloads Syllabus

What is a subnet in a VNet and why segment a VNet into subnets?

A subnet is a sub-range of the VNet's IP address space. Segmenting improves security and organisation by isolating resources, allowing different network security rules (NSGs) and routing to be applied to each subnet.

How is the address space of a VNet/subnet defined, and how many usable IPs does a /24 subnet provide in Azure?

Address space is defined using CIDR notation (e.g. $10.0.0.0/16$). A $/24$ subnet contains $2^{8}=256$ addresses, but Azure reserves 5 per subnet, leaving $256-5=251$ usable host IPs.

What is VNet Peering?

A mechanism that connects two VNets, allowing resources in each to communicate privately over the Microsoft backbone as if in the same network. It can be regional (same region) or global (across regions). Traffic stays on the Microsoft network, not the public internet.

What is a Network Security Group (NSG)?

A set of security rules that allow or deny inbound and outbound network traffic to Azure resources, based on source/destination IP, port, and protocol. NSGs can be associated with subnets or network interfaces (NICs).

Compare the main Azure hybrid connectivity options: VPN Gateway vs ExpressRoute.

VPN Gateway creates an encrypted tunnel over the public internet (site-to-site or point-to-site); cheaper but variable performance. ExpressRoute provides a private, dedicated connection via a connectivity provider — higher bandwidth, lower latency, more reliable, and does NOT traverse the public internet.

What is an Azure VPN Gateway and what are point-to-site vs site-to-site connections?

A VPN Gateway sends encrypted traffic between Azure and on-premises over the internet. Site-to-site (S2S) connects an entire on-premises network to a VNet via a VPN device. Point-to-site (P2S) connects an individual client device to a VNet.

What is Azure ExpressRoute and what bandwidths and peering types does it support?

A private, dedicated connection to Azure via a connectivity provider, bypassing the public internet. Supports bandwidths up to $100\,\text{Gbps}$ and peering types: Private peering (to VNets) and Microsoft peering (to Microsoft 365/public services).

What is Azure DNS?

A hosting service for DNS domains that provides name resolution using Microsoft Azure's global infrastructure. It lets you manage public DNS records for your domain (e.g. mapping names to IPs) but does not register domain names.

What is an Azure Private DNS Zone used for?

It provides name resolution for resources within and between VNets without exposing records to the public internet, allowing custom private domain names instead of Azure-provided names.

List common DNS record types and what each maps.

A (name → IPv4 address), AAAA (name → IPv6 address), CNAME (alias → another domain name), MX (mail exchange server), TXT (text data, e.g. verification), NS (nameserver), and SOA (start of authority/zone info).

What are the four types of Azure Storage Account services (data services)?

Blob storage (objects/unstructured data), File storage (managed SMB/NFS file shares), Queue storage (messaging between app components), and Table storage (NoSQL key-value structured data). Azure Disks are also storage account-related for VM disks.

What are the three Azure Blob access tiers and their use cases?

Hot (frequently accessed data, highest storage cost, lowest access cost), Cool (infrequently accessed, stored at least 30 days), and Archive (rarely accessed, lowest storage cost but high retrieval cost/latency, stored at least 180 days).

What are the three types of blobs in Azure Blob Storage?

Block blobs (text/binary files, documents, media — most common), Append blobs (optimised for append operations like logging), and Page blobs (random read/write, used for VHDs / Azure VM disks).

What is Locally Redundant Storage (LRS) and how many copies does it keep?

LRS keeps 3 synchronous copies of your data within a single physical location (datacentre) in the primary region. It provides at least 99.999999999% (eleven nines) durability over a year but no protection against datacentre-level failure.

What is Zone-Redundant Storage (ZRS)?

ZRS replicates data synchronously across three Azure Availability Zones in the primary region, protecting against the failure of a single zone/datacentre while keeping data within one region.

Compare GRS and GZRS storage redundancy.

GRS (Geo-Redundant Storage) = LRS in the primary region plus asynchronous copy to a secondary region (3 copies in each via LRS). GZRS (Geo-Zone-Redundant Storage) = ZRS in the primary region (across 3 zones) plus async copy to a secondary region. GZRS gives both zone and regional protection.

What does the 'RA' prefix mean in RA-GRS / RA-GZRS?

RA = Read-Access. It allows read-only access to the data in the secondary region even when the primary region is available, instead of only after a failover.

How many copies of data does GRS maintain in total and across how many regions?

GRS maintains 6 copies of the data in total — 3 in the primary region and 3 in the secondary region — providing at least 16 nines (99.99999999999999%) durability over a year.

What is AzCopy?

A command-line utility for copying/migrating data to and from Azure Blob and File storage, and between storage accounts. It is optimised for high-performance, scriptable bulk data transfer.

What is Azure Storage Explorer?

A standalone GUI application (Windows/macOS/Linux) for visually managing and transferring data in Azure storage accounts — blobs, files, queues, and tables — without using the portal or command line.

What is the Azure Data Box family and when is it used for migration?

A set of physical offline transfer devices (Data Box Disk, Data Box, Data Box Heavy) shipped to your site to move very large volumes of data (terabytes to petabytes) when network transfer would be too slow or costly. Data is copied locally then physically shipped back to Azure.

What is Azure Database Migration Service (DMS)?

A fully managed service that enables seamless migrations of multiple database sources to Azure data platforms (e.g. SQL Server to Azure SQL) with minimal downtime, supporting both offline and online migrations.

What is Azure SQL Database and which deployment options does it offer?

A fully managed PaaS relational database engine based on SQL Server. Deployment options: Single Database (isolated, own resources), Elastic Pool (databases sharing a resource pool), and it is distinct from Azure SQL Managed Instance (near-100% SQL Server compatibility).

What is Azure Cosmos DB?

A globally distributed, multi-model, fully managed NoSQL (and relational) database offering single-digit-millisecond latency, elastic scaling, and turnkey global distribution. Supports multiple APIs: NoSQL (Core/SQL), MongoDB, Cassandra, Gremlin (graph), and Table.

What are the managed open-source relational database services in Azure?

Azure Database for MySQL, Azure Database for PostgreSQL, and Azure Database for MariaDB — fully managed PaaS offerings handling patching, backups, and high availability for these open-source engines.

What is Azure Synapse Analytics?

An integrated analytics service that combines enterprise data warehousing, big data analytics (Apache Spark), and data integration pipelines in one unified workspace for large-scale data analysis and reporting.

What is Azure Databricks?

A fully managed, Apache Spark-based analytics and machine learning platform (a first-party Azure/Databricks partnership) used for big data processing, data engineering, and collaborative data science.

What is Azure Data Factory?

A cloud-based, serverless data integration (ETL/ELT) service for creating, scheduling, and orchestrating data pipelines that move and transform data between many sources at scale.

What is the difference between Azure IoT Hub and Azure IoT Central?

IoT Hub is a PaaS message broker enabling secure bidirectional communication between IoT devices and the cloud (you build the solution). IoT Central is a higher-level managed SaaS application platform with dashboards and templates for quickly building IoT solutions with minimal coding.

What is Azure Cognitive Services / Azure AI Services?

A set of prebuilt, cloud-based AI APIs and models that let developers add capabilities — Vision, Speech, Language, Decision, and OpenAI — to apps without machine-learning expertise. Examples include Computer Vision, Translator, and the Speech service. Azure Machine Learning, by contrast, is used to build, train, and deploy custom ML models.