Microsoft Azure Syllabus

What is Azure App Service?

A fully managed PaaS for building, deploying, and scaling web apps, REST APIs, and mobile backends in multiple languages (.NET, Java, Node.js, Python, PHP) without managing the underlying infrastructure.

What is an App Service Plan?

It defines the compute resources (region, VM size/SKU, number of instances, pricing tier) on which App Service apps run. Multiple apps can share one plan, and the plan determines cost and scaling capabilities.

What are deployment slots in Azure App Service?

Live app environments (e.g., staging and production) within an App Service that let you deploy and test a new version, then swap it into production with zero downtime and easy rollback.

What is Azure Kubernetes Service (AKS)?

A managed Kubernetes container-orchestration service where Azure manages the Kubernetes control plane (for free), and the customer manages and pays for the agent/worker nodes that run containerized workloads.

In AKS, who manages the control plane versus the nodes?

Microsoft/Azure manages the control plane (API server, etcd, scheduler) at no charge; the customer manages and pays for the worker node pool (VMs) that run the pods.

What is a 'pod' in the context of Kubernetes/AKS?

A pod is the smallest deployable unit in Kubernetes: one or more containers that share the same network namespace (IP), storage, and lifecycle, and are scheduled together on a node.

What are the four main types of Azure Storage in a general-purpose v2 storage account?

Blob storage (objects), File storage (SMB/NFS file shares), Queue storage (messaging), and Table storage (NoSQL key-value). Disk storage is provided separately as managed disks.

What is Azure Blob Storage?

An object storage service for storing massive amounts of unstructured data (text, images, video, backups) accessed over HTTP/HTTPS via REST APIs, organized into containers within a storage account.

What are the three types of blobs in Azure Blob Storage?

Block blobs (for text/binary files and most objects), Append blobs (optimized for append operations like logging), and Page blobs (for random read/write, used as the backing for VM disks).

Name the Azure Blob Storage access tiers and their intended use.

Hot (frequent access, higher storage cost/lower access cost), Cool (infrequently accessed, 30+ days), Cold (rarely accessed, 90+ days), and Archive (offline, lowest cost, rare access, requires rehydration).

What is Azure File Storage (Azure Files)?

A fully managed file share service in the cloud accessible via the SMB and NFS protocols, mountable simultaneously by cloud and on-premises machines, and integrable with Active Directory for permissions.

What is the key difference between Azure Blob Storage and Azure File Storage?

Blob Storage is object storage accessed via REST APIs (no native file-system hierarchy), ideal for unstructured data. Azure Files provides a true network file share accessed via SMB/NFS and can be mounted like a drive.

What is Azure Disk Storage?

Block-level storage volumes (managed disks) attached to Azure Virtual Machines, functioning like physical disks, available as OS disks, data disks, and temporary disks, in tiers from Standard HDD to Ultra Disk.

What are the Azure storage data redundancy options within a single region?

LRS (Locally Redundant Storage — 3 copies in one data center) and ZRS (Zone-Redundant Storage — 3 copies across availability zones in one region).

What are the cross-region (geo) redundancy options for Azure Storage?

GRS (Geo-Redundant Storage — LRS in primary plus async copy to a secondary region) and GZRS (Geo-Zone-Redundant Storage — ZRS in primary plus copy to secondary region). RA-GRS/RA-GZRS add read access to the secondary.

How many total copies of data does GRS maintain, and where?

GRS maintains 6 copies total: 3 in the primary region (LRS) and 3 in a paired secondary region hundreds of miles away.

What is an Azure Virtual Network (VNet)?

A logically isolated, private network in Azure that lets Azure resources (like VMs) securely communicate with each other, the internet, and on-premises networks, using a defined private IP address space and subnets.

What is a subnet within a VNet, and why is it used?

A subnet is a segmented range of the VNet's IP address space that divides the network into smaller sections for organization, isolation, and applying different security/routing rules to groups of resources.

What is a Network Security Group (NSG)?

A set of security rules (allow/deny) filtering inbound and outbound network traffic to/from Azure resources based on source/destination IP, port, and protocol. NSGs can be associated with subnets or NICs.

What is VNet Peering?

A mechanism that connects two Azure Virtual Networks so resources in each can communicate privately using Microsoft's backbone network, as if on the same network. It can be regional or global (across regions).

What is the Azure Load Balancer, and at which OSI layer does it operate?

A Layer 4 (TCP/UDP transport layer) load balancer that distributes inbound network traffic across multiple backend resources (e.g., VMs) to ensure high availability and scalability.

What is the difference between a public and an internal (private) Azure Load Balancer?

A public Load Balancer has a public IP and distributes internet traffic to backend VMs. An internal Load Balancer uses a private IP and balances traffic only within a VNet (e.g., between application tiers).

How does Azure Load Balancer differ from Azure Application Gateway?

Load Balancer works at Layer 4 (TCP/UDP) routing by IP/port. Application Gateway works at Layer 7 (HTTP/HTTPS), enabling URL-based/path-based routing, SSL termination, and an optional Web Application Firewall (WAF).

What is an Azure VPN Gateway?

A specific type of virtual network gateway that sends encrypted traffic between an Azure VNet and an on-premises location (Site-to-Site) or individual clients (Point-to-Site) over the public internet using IPsec/IKE.

What is the difference between Site-to-Site and Point-to-Site VPN connections?

Site-to-Site (S2S) connects an entire on-premises network to an Azure VNet via a VPN device over IPsec. Point-to-Site (P2S) connects an individual client computer to the VNet, useful for remote workers.

How does Azure VPN Gateway differ from Azure ExpressRoute?

VPN Gateway sends encrypted traffic over the public internet (IPsec). ExpressRoute establishes a private, dedicated connection through a connectivity provider that does not traverse the public internet, offering higher reliability, lower latency, and more bandwidth.

What is Azure SQL Database?

A fully managed PaaS relational database service based on the Microsoft SQL Server engine, providing automatic patching, backups, high availability, and scaling without managing the underlying infrastructure.

What are the two main purchasing/pricing models for Azure SQL Database?

The DTU-based model (Database Transaction Units, a bundled measure of compute, memory, and I/O) and the vCore-based model (choose vCores and memory independently, with hardware and licensing flexibility).

What is the difference between Azure SQL Database and Azure SQL Managed Instance?

Azure SQL Database is a single database/elastic pool PaaS optimized for modern cloud apps. SQL Managed Instance provides near-100% compatibility with on-premises SQL Server (instance-level features), ideal for lift-and-shift migrations.

What is Azure Cosmos DB?

A fully managed, globally distributed, multi-model NoSQL (and relational-capable) database service offering single-digit millisecond latency, elastic scalability, and turnkey global distribution with multiple consistency levels.

What are the five consistency levels offered by Azure Cosmos DB, from strongest to weakest?

Strong, Bounded Staleness, Session, Consistent Prefix, and Eventual. Strong offers the most consistency but highest latency; Eventual offers the highest availability/lowest latency but weakest consistency.

What unit does Azure Cosmos DB use to measure and provision throughput?

Request Units per second (RU/s) — a normalized currency that abstracts the CPU, memory, and IOPS cost of database operations. Reading a 1 KB item costs approximately 1 RU.

Name three of the API models supported by Azure Cosmos DB.

API for NoSQL (Core/SQL), API for MongoDB, API for Apache Cassandra, API for Apache Gremlin (graph), and API for Table. (Any three are correct.)

What is Azure Database for MySQL / PostgreSQL?

Fully managed PaaS relational database services running the community MySQL and PostgreSQL engines, with built-in high availability, automated backups, patching, and scaling, so you don't manage the servers.

What is the difference between the 'Single Server' and 'Flexible Server' deployment options for Azure Database for MySQL/PostgreSQL?

Single Server is the original, fully managed but less configurable option (being retired). Flexible Server offers more control over configuration, cost optimization (stop/start), zone-redundant HA, and maintenance scheduling.

What is Azure Active Directory (now Microsoft Entra ID)?

A cloud-based identity and access management (IAM) service that handles authentication and authorization, enabling users to sign in and access Azure, Microsoft 365, and thousands of SaaS applications with single sign-on (SSO).

What is the difference between authentication and authorization in Azure AD?

Authentication (AuthN) verifies who a user is (identity/login). Authorization (AuthZ) determines what an authenticated user is allowed to do (permissions/access to resources).

What is Multi-Factor Authentication (MFA) in Azure AD?

A security process requiring two or more verification factors — something you know (password), something you have (phone/token), or something you are (biometric) — to sign in, greatly reducing the risk of compromised credentials.

What is Role-Based Access Control (RBAC) in Azure?

An authorization system that grants users, groups, or applications fine-grained access to Azure resources by assigning roles (a set of permissions) at a defined scope (management group, subscription, resource group, or resource).

What are the three core components of an Azure RBAC role assignment?

Security principal (who — user, group, service principal, or managed identity), Role definition (what actions are allowed), and Scope (where the access applies).

What is Azure AD Conditional Access?

A policy-based feature that enforces access controls (e.g., require MFA, block, or require compliant device) based on signals such as user, location, device state, and risk level — an 'if-then' identity-driven firewall.

What is a Managed Identity in Azure AD?

An automatically managed identity in Azure AD that lets Azure resources (like a VM or App Service) authenticate to services supporting Azure AD without storing credentials in code. Types: system-assigned and user-assigned.

What is a Service Principal in Azure AD?

An identity created for an application, service, or automation tool to access specific Azure resources, defining the app's access policy and permissions within a tenant — essentially an application's 'user account'.

What is an Azure Availability Set, and what does it protect against?

A logical grouping of VMs that Azure distributes across multiple fault domains (separate hardware/power/network) and update domains (separate maintenance groups), protecting against hardware failures and planned maintenance within a single data center.