AZ-900 Microsoft Azure Fundamentals Exam

Describe the core architectural components of Azure

Azure's core architecture starts with regions, which are physical data centers located around the world. Each region contains multiple data centers connected through low-latency networking, allowing services to run close to users. When you deploy a service in Azure, you choose a region, and Microsoft manages the underlying hardware, power, and networking for that location.

Above regions, Azure uses availability zones to protect against data center failures. Each availability zone is a physically separate location within a region with its own power, cooling, and network. For critical applications, you can distribute resources across multiple zones so that if one zone goes down, the others keep running.

Resource groups serve as containers that hold related resources for a solution. All resources in a group share the same lifecycle, meaning you can deploy, update, and delete them together. The resource group itself sits in a specific region, though the resources within it can be in different regions.

Azure Resource Manager (ARM) is the deployment and management layer for all Azure services. When you create or modify resources, your request goes to ARM, which handles authentication, validates your request, and coordinates the actual provisioning. ARM also enables you to use templates to define your infrastructure as code, so deployments are repeatable and consistent.

Describe Azure compute and networking services

Virtual machines are Azure's core compute option, providing emulated computers that run in Azure's data centers. You choose the size (CPU and memory), operating system, and storage for each VM, and Azure hosts it on physical servers. VMs give you full control over the operating system, making them ideal for applications that need specific configurations or custom software.

Azure App Service is a managed platform for hosting web applications and APIs. You upload your code, and Azure handles the underlying servers, scaling, and maintenance. This service supports multiple programming languages and automatically scales based on traffic, so you don't need to manage infrastructure.

Azure Kubernetes Service (AKS) manages containerized applications using Kubernetes, an open-source system for automating deployment and scaling. Containers package an application with everything it needs to run, making them portable across different environments. AKS handles the Kubernetes control plane, while you manage the worker nodes running your containers.

Azure Virtual Network creates isolated network environments in the cloud, similar to a traditional data center network. Virtual networks contain subnets, which are smaller address spaces that segment network traffic. Network security groups filter traffic by rules you define, controlling which resources can communicate with each other.

Azure Load Balancer distributes incoming traffic across multiple VMs to ensure no single server becomes overwhelmed. It performs health checks on each server and stops sending traffic to any that fail, automatically routing users to healthy instances. This works for both public internet traffic and internal traffic between services.

Describe Azure storage services

Azure Blob Storage stores massive amounts of unstructured data like images, videos, and documents. Data is organized into containers, and you access it via a unique URL. Blob Storage offers three tiers—hot, cool, and archive—letting you balance cost against how often you need to access the data.

Azure Files provides fully managed file shares accessible via the standard Server Message Block (SMB) protocol. Applications that normally run on local file servers can use Azure Files without code changes, and the shares can be mounted on both Windows and Linux systems.

Azure Disk Storage provides high-performance block storage for Azure VMs. Each disk is a virtual hard drive that attaches to a VM, and you can choose between standard hard disk drives for lower cost or solid-state drives for better performance.

Azure Queue Storage enables asynchronous messaging between application components. When one part of an application needs to communicate with another, it places a message in a queue, and the receiving component processes it at its own pace. This decouples the parts of a system so they can operate independently.

Azure Storage Account is the container that holds all your storage services. When you create a storage account, you choose a replication option that determines how your data is protected: locally redundant storage keeps three copies in one facility, while geo-redundant storage maintains copies in a secondary region for disaster recovery.

Describe Azure identity, access, and security

Azure Active Directory (Azure AD) is Microsoft's cloud-based identity and access management service. It validates user credentials and issues tokens that applications use to confirm who is making a request. Azure AD supports single sign-on, meaning users log in once and access all authorized applications without re-entering passwords.

Role-based access control (RBAC) manages who can access what resources in Azure. You assign roles—such as reader, contributor, or owner—to users or groups, and each role defines a set of permissions. A reader can view resources, a contributor can modify them, and an owner has full control including the ability to grant access to others.

Conditional Access policies add extra security checks beyond simple authentication. For example, you can require multi-factor authentication when users access sensitive resources from unfamiliar locations. The policy evaluates signals like user location, device status, and risk level before granting access.

Azure Security Center provides unified security management across your Azure resources and on-premises environments. It continuously monitors for threats, assigns a security score, and recommends actions to improve your posture. When it detects suspicious activity, it generates alerts so you can investigate and respond.

Azure Key Vault stores secrets, keys, and certificates securely. Instead of embedding passwords or API keys in your code, you retrieve them from Key Vault at runtime. Access is controlled through Azure AD, and Key Vault logs all access attempts for auditing.