DevOps Microsoft Azure Flashcards

24 sample cards from the Microsoft Azure deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is an Azure Virtual Network (VNet)?

   A logically isolated, private network in Azure that lets your resources (VMs, etc.) securely communicate with each other, the internet, and on-premises networks. It is scoped to a single region and subscription and is divided into subnets.

2. What is a subnet in an Azure VNet, and how is its address space defined?

   A subnet is a sub-range of a VNet's IP address space (defined in CIDR notation, e.g. $10.0.1.0/24$) used to segment the network and apply policies. Resources are deployed into specific subnets.

3. What is VNet peering?

   A mechanism that connects two Azure virtual networks so traffic routes privately through Microsoft's backbone (not the public internet). It can be regional (same region) or global (across regions); peering is non-transitive by default.

4. What is a Network Security Group (NSG)?

   A set of prioritized inbound and outbound security rules (allow/deny by source/destination IP, port, and protocol) that filter network traffic to and from Azure resources within a VNet, attached to subnets or NICs.

5. What is Azure Load Balancer?

   A Layer 4 (TCP/UDP) load balancer that distributes inbound network traffic across a backend pool of healthy VMs to provide high availability and scalability, using health probes and load-balancing rules.

6. What is the difference between a public and an internal Azure Load Balancer?

   A public (external) Load Balancer has a public IP and balances internet traffic to backend VMs. An internal (private) Load Balancer uses a private IP and balances traffic only within a VNet (e.g., a tiered/internal application).

7. How does Azure Load Balancer differ from Azure Application Gateway?

   Load Balancer operates at Layer 4 (transport, TCP/UDP). Application Gateway operates at Layer 7 (HTTP/HTTPS), offering URL path-based routing, SSL termination, cookie-based session affinity, and a Web Application Firewall (WAF).

8. What is the role of a health probe in Azure Load Balancer?

   It periodically tests backend instances; only instances that respond as healthy receive traffic. Unhealthy instances are removed from rotation until they pass the probe again, ensuring traffic goes only to working endpoints.

9. What is Azure VPN Gateway?

   A specific type of virtual network gateway that sends encrypted traffic between an Azure VNet and on-premises locations (site-to-site) or individual clients (point-to-site) over the public internet using IPsec/IKE tunnels.

10. Compare Site-to-Site, Point-to-Site, and VNet-to-VNet VPN connections.

    Site-to-Site connects an on-premises network to a VNet via IPsec over the internet. Point-to-Site connects an individual client device to a VNet. VNet-to-VNet connects two Azure VNets through their VPN gateways.

11. How does Azure VPN Gateway differ from Azure ExpressRoute?

    VPN Gateway sends encrypted traffic over the public internet (lower cost, variable performance). ExpressRoute provides a private, dedicated connection through a connectivity provider, bypassing the internet for higher bandwidth, lower latency, and reliability.

12. What is Azure SQL Database?

    A fully managed PaaS relational database based on the latest stable Microsoft SQL Server engine, with automated patching, backups, high availability, and scaling, so you do not manage the OS or SQL Server installation.

13. What are the purchasing/deployment models for Azure SQL Database?

    Deployment options: Single database, Elastic pool (shared resources across databases), and Managed Instance. Purchasing models: DTU-based (bundled compute/storage/IO) and vCore-based (independently chosen compute and storage).

14. What is a DTU in Azure SQL Database?

    A Database Transaction Unit—a blended measure of compute (CPU), memory, and I/O resources. Higher DTU tiers give more performance; it bundles these resources into preconfigured service levels (Basic, Standard, Premium).

15. What is Azure Cosmos DB?

    A globally distributed, multi-model NoSQL (and relational via PostgreSQL API) database service offering turnkey global distribution, elastic scaling of throughput/storage, and single-digit-millisecond latency with comprehensive SLAs.

16. Name the API models supported by Azure Cosmos DB.

    NoSQL (Core/SQL), MongoDB, Apache Cassandra, Apache Gremlin (graph), Table, and PostgreSQL. The API determines the data model and query language used to interact with the data.

17. What are the five consistency levels in Azure Cosmos DB?

    From strongest to weakest: Strong, Bounded Staleness, Session, Consistent Prefix, and Eventual. They trade off consistency against latency and availability—Strong gives linearizable reads; Eventual gives the lowest latency.

18. What is a Request Unit (RU) in Azure Cosmos DB?

    The normalized currency for throughput, abstracting the CPU, memory, and IOPS needed for operations. Throughput is provisioned in RU/s; for example a point read of a 1 KB item costs $1$ RU.

19. What is Azure Database for MySQL/PostgreSQL?

    Fully managed PaaS offerings of the open-source MySQL and PostgreSQL community database engines on Azure, providing automated patching, backups, high availability, and scaling while remaining compatible with existing open-source tools and apps.

20. What is the recommended deployment model for Azure Database for MySQL/PostgreSQL, and why?

    The Flexible Server deployment model. It gives more granular control and flexibility over database configuration, maintenance windows, zone-redundant high availability, and cost optimization (including stop/start) compared to the older Single Server model.

21. What is Microsoft Entra ID (formerly Azure Active Directory)?

    A cloud-based identity and access management (IAM) service that handles authentication and authorization, providing single sign-on (SSO), multi-factor authentication (MFA), and conditional access for users to Azure, Microsoft 365, and other apps.

22. How does Azure AD (Entra ID) differ from on-premises Active Directory Domain Services (AD DS)?

    Azure AD is a cloud, internet-based identity provider using protocols like OAuth 2.0, OpenID Connect, and SAML for web/app SSO. On-prem AD DS is a hierarchical, domain-based directory using Kerberos/LDAP for managing devices and users on a corporate network.

23. What is Azure Role-Based Access Control (RBAC) and its three core elements?

    RBAC authorizes access to Azure resources via role assignments. Each assignment combines a security principal (user/group/service principal), a role definition (set of permissions like Reader, Contributor, Owner), and a scope (management group, subscription, resource group, or resource).

24. What is Conditional Access in Microsoft Entra ID?

    A policy engine that enforces access controls based on signals (user, device, location, risk). It applies if-then rules—for example, requiring MFA or a compliant device when a sign-in comes from an untrusted location—to balance security and usability.

What this deck covers

Microsoft Azure flashcards FAQ