Quick revision

AZ-900 flashcards and glossary

395 flashcards from 79 topics. Try to answer before you flip the card.

Glossary

Access control boundary: Permissions and policies can be applied at the subscription level for everything inside.
Access tier: Hot, Cool, Cold or Archive, which trades storage price against access price.
Action group: A set of notification and automation actions (email, SMS, webhook, Logic App) triggered by alerts.
Address space: The private IP range of a VNet, written in CIDR notation such as 10.0.0.0/16.
Advisor score: A score showing how well you follow Advisor's best-practice recommendations.
Agility: The ability to try, launch and change things quickly because resources are available in minutes.
Alias record: A DNS record that points directly to an Azure resource and updates if its IP changes.
Always customer-owned: Information and data, devices (mobile and PCs), and accounts and identities, in every model.
App Service plan: The set of compute resources (size and number of instances) your apps run on, and what you pay for.
Application Insights: Application performance monitoring (APM) feature of Azure Monitor.
Arc-enabled Kubernetes: A Kubernetes cluster anywhere, managed and governed from Azure.
Arc-enabled server: A non-Azure Windows or Linux machine connected to Azure through the Arc agent.
ARM template: A declarative JSON file that defines Azure resources and their configuration.
Assessment: Analysis of readiness, right-sizing and estimated cost before migrating.
Assume breach: Design as if attackers are already inside. Segment, encrypt and monitor.
Authentication: Proving who you are (AuthN).
Authorization: Deciding what you are allowed to do (AuthZ).
Autoscale: Rules or metrics that automatically change the number of instances (for example, add 2 instances when CPU > 70%).
Availability set: Places VMs in different fault and update domains within a datacenter.
Availability zone: A physically separate group of one or more datacenters within a region, with independent power, cooling and networking.
AzCopy: A command-line tool for copying data to, from and between storage accounts.
Azure account: The identity (in a Microsoft Entra tenant) used to sign in and own subscriptions.
Azure Advisor: A free service that analyses your resources and recommends improvements.
Azure Arc: Extends Azure management to resources running outside Azure.
Azure CLI: Cross-platform command-line tool using az commands, popular with Bash users.
Azure Cloud Shell: A browser-based, authenticated shell with Azure CLI and PowerShell preinstalled.
Azure Container Registry (ACR): A private registry for storing container images.
Azure Cosmos DB: Globally distributed, multi-model NoSQL database with low latency and elastic scale.
Azure Data Box: A physical storage device for offline transfer of large data sets to or from Azure.
Azure File Sync: Synchronises Windows Server file shares with Azure Files, with optional cloud tiering.
Azure Files: Managed file shares accessible over SMB or NFS, like a network drive.
Azure Functions: Serverless, event-driven compute that runs code on demand.
Azure Hybrid Benefit: Use existing on-premises Windows Server and SQL Server licences (with Software Assurance or qualifying subscriptions) to reduce Azure costs.
Azure Local: Microsoft's solution (formerly Azure Stack HCI) for running virtualised workloads on validated hardware in your own location, managed through Azure.
Azure Marketplace: A store of third-party solutions, billed through your Azure subscription.
Azure Migrate: A unified hub for discovery, assessment and migration of workloads to Azure.
Azure Policy: A service that evaluates resources against rules and can audit, deny or remediate non-compliant ones.
Azure portal: The browser-based graphical console for Azure.
Azure PowerShell: A set of PowerShell cmdlets (the Az module) for managing Azure.
Azure Private Link: The technology behind private endpoints that keeps traffic on the Microsoft backbone.
Azure region: A geographic area containing one or more Azure datacenters, for example West Europe or Southeast Asia.
Azure Reservations: Commit to a specific resource type, size and region for 1 or 3 years for a significant discount.
Azure Resource Manager: The deployment and management layer that processes every Azure management request.
Azure savings plan for compute: Commit to a fixed hourly spend on compute for 1 or 3 years; discount applies flexibly across eligible services and regions.
Azure SQL Database: Fully managed PaaS relational database based on the SQL Server engine.
Azure status: A public, global page showing the health of all Azure services across regions.
Azure Storage Explorer: A cross-platform desktop GUI for managing Azure Storage.
Azure Well-Architected Framework: Microsoft's guidance built around five pillars (reliability, security, cost optimization, operational excellence, performance efficiency).
B2B collaboration: Inviting external users as guests who sign in with their own credentials.
B2B direct connect: A trust with another Entra organisation, used for Teams shared channels.
Bicep: A concise Azure language that compiles to ARM templates.
Billing boundary: Each subscription gets its own invoices and cost reports.
Binding: A declarative connection to input or output data, such as writing to a queue, without extra code.
Blade: A panel in the portal that opens to show a resource or setting.
Blast radius: How much damage one breach can cause. Layers keep it small.
Blob: Binary large object. Any file stored in Blob Storage.
Branch: A remote office connected through VPN or SD-WAN.
Budget: A spending limit with alerts at chosen percentages of actual or forecast cost.
Business case (Azure Migrate): A TCO and savings report built from discovery data of your real servers.
CapEx: Capital expenditure. Up-front spending on physical assets that are owned and depreciated over time.
Cash flow: The timing of money going out and coming in. Big CapEx purchases hit cash flow immediately.
CIDR: Classless Inter-Domain Routing notation for IP ranges, such as /16 or /24.
Classification: Labelling data, such as credit card numbers or personal data, automatically.
Cloud bursting: Running normally on-premises and "bursting" extra demand into the public cloud during peaks.
Cloud computing: Renting computing services over the internet, on demand, instead of owning the hardware.
Cloud provider: The company that owns the datacenters and rents out the services, for example Microsoft (Azure).
Cloud security posture management (CSPM): Continuously assessing configuration against best practices.
Cloud tiering: Keeps frequently used files on the local server and leaves the rest in Azure.
Cloud workload protection (CWP): Threat detection for workloads such as servers, containers, storage and databases (Defender plans).
Cold start: Extra delay when a function runs after being idle and a new instance must start.
Compliance: Meeting the requirements of laws, regulations and industry standards (for example GDPR, ISO 27001, PCI DSS).
Conditional Access policy: An if-then rule combining signals and an access decision.
Configuration vs customisation: SaaS lets you configure settings and workflows, but you cannot change the vendor's underlying code.
Connectivity provider: A telecom or exchange partner that provides the physical connection.
Consumption-based model: Paying for actual usage of resources rather than for fixed capacity bought in advance.
Container: A folder-like grouping of blobs inside a storage account.
Container image: A packaged, versioned app plus its dependencies, stored in a registry such as Azure Container Registry.
Control vs convenience: The core trade-off. IaaS gives the most control, SaaS the most convenience.
Cool-down: A waiting period after a scale action before the next one, to avoid flapping up and down.
Cost alert: A notification, such as a budget alert, credit alert or department spending quota alert.
Cost analysis: Interactive charts of spending by service, resource group, tag, region and time.
Cost predictability: Confidence in what the cloud will cost, through forecasting, monitoring and controls.
Dashboard: A customisable view of tiles showing the resources and metrics you care about.
Data governance: Knowing and managing what data you have, where it is and how it is used.
Data lineage: Tracking where data comes from and where it flows.
Data map: An automatically built inventory of data sources and assets.
Datacenter: A secure building with racks of servers, power, cooling and networking.
DDoS attack: Distributed Denial of Service. Flooding a service with traffic from many sources to make it unavailable.
Deallocated: A stopped VM whose hardware is released, so compute billing stops.
Declarative: Describe what you want; the tool decides how to create it.
Dedicated host: An option to run your VMs on a physical server not shared with other customers, still inside the public cloud.
Defense in depth: A layered security strategy with protections at every level.
Delete lock (CanNotDelete): Users can read and modify a resource but cannot delete it.
Deployment slot: A live staging copy of your app you can swap into production with no downtime.
Depreciation: Spreading the cost of an asset over its useful life in the accounts, because its value declines.
Desktop virtualisation: Running a user's desktop in a datacenter and streaming it to their device.
Disaster recovery (DR): The plans and tooling to restore service after a major incident, such as a regional outage.
DNS: Domain Name System, the internet's phone book that turns names into IP addresses.
DNS zone: A container for the DNS records of one domain, such as contoso.com.
Economies of scale: Large providers buy hardware and power so cheaply that they can offer lower unit costs than one company could achieve.
Effect: What happens when a rule matches, such as Audit, Deny, Modify or DeployIfNotExists.
Egress: Data leaving Azure or moving between regions, which is usually charged.
Elasticity: Automatically and rapidly matching resources to current demand, up and down.
Encryption at rest: Data stored on disk is encrypted. It is enabled by default for Azure Storage and Azure SQL Database.
Estimate: A saved list of services and options with a predicted monthly cost.
Event-driven: Code runs in response to something happening, such as an HTTP request, a new file, a queue message or a timer.
ExpressRoute: A private, dedicated connection between your network and Azure that does not travel over the public internet.
ExpressRoute circuit: The logical private connection between your network and Microsoft through a provider.
ExpressRoute Global Reach: Connects your on-premises sites to each other through the Microsoft network.
External identity: An identity from outside your organisation used to access your resources.
Failover: Switching to a standby component or location when the primary fails.
Fault domain: A group of hardware sharing a power source and network switch, like a rack.
General availability (GA): A fully released, supported service, normally covered by an SLA.
Geography: A larger area, usually a country or market, containing one or more regions and respecting data residency boundaries.
Global VNet peering: Peering between virtual networks in different Azure regions.
Governance: Policies and processes that ensure cloud resources meet organisational and regulatory standards.
Grant control: The requirement or decision, such as require MFA, require a compliant device, or block.
GRS: Geo-redundant storage. LRS plus asynchronous copy to a secondary region.
Guardrails: Automated controls that keep teams within safe boundaries without slowing them down.
GZRS: Geo-zone-redundant storage. ZRS plus asynchronous copy to a secondary region.
Hardware refresh: Replacing ageing servers, typically every 3–5 years, which is a major recurring capital cost on-premises.
Health probe: A regular check that removes unhealthy backends from rotation.
High availability (HA): Keeping a service accessible with minimal downtime, despite failures of individual components.
Horizontal scaling (scale out/in): Changing the number of instances, such as going from 2 web servers to 10.
Host pool: A group of VMs that serve desktops to users.
Hybrid cloud: A combination of public cloud with private cloud or on-premises infrastructure, connected so workloads and data can interact.
Hypervisor: Software that runs multiple isolated VMs on one physical server.
IaaS: Infrastructure as a Service. Rent VMs, storage and networks; you manage the OS, runtime, apps and data.
Idempotent: Deploying the same template many times gives the same result.
Image: The template the VM starts from, such as Ubuntu Server or Windows Server.
Imperative: Write step-by-step commands, as in a script.
Infrastructure as code: Defining and deploying infrastructure through code files.
Infrastructure as code (IaC): Defining infrastructure in files (Bicep, ARM templates, Terraform) so it can be versioned and deployed repeatably.
Inheritance: Settings at a parent scope automatically apply to child scopes.
Initiative: A group of related policy definitions assigned together.
KQL: Kusto Query Language, used to query logs.
Kubernetes: An open-source system for deploying, scaling and healing containers automatically.
Layer 4: Transport layer (TCP/UDP). Routing by IP address and port only.
Layer 7: Application layer (HTTP/HTTPS). Routing can use URLs, headers and cookies.
Least privilege: Limit access with just-in-time and just-enough-access.
Lifecycle: When resources are created, updated and deleted. Resources with the same lifecycle belong in the same group.
Lift and shift: Moving an application to the cloud with as few changes as possible, usually onto virtual machines.
Lift and shift (rehost): Moving an existing application to cloud VMs with minimal changes.
Lock inheritance: A lock on a resource group or subscription applies to everything inside.
Logs: Records of events and data, queried with KQL in Log Analytics.
LRS: Locally redundant storage. 3 copies in one datacenter.
Managed Disk: A block storage volume attached to an Azure VM.
Managed service: A service where the provider handles operations like patching, backups and high availability for you.
Management group: A container above subscriptions used to apply policy and access across many subscriptions.
Management in the cloud: The interfaces used to manage resources, such as the Azure portal, CLI, PowerShell, APIs and SDKs.
Management of the cloud: Managing your cloud resources, such as scaling, deploying from templates, monitoring and alerting, and automatic replacement of failed resources.
Measured service: Usage is metered (per second, per GB, per request) so you are billed for what you actually consume.
Meter: The unit Azure uses to measure a resource's usage, such as VM hours, GB stored per month or millions of executions.
Metrics: Numeric values collected at regular intervals, such as CPU percentage.
MFA: Requiring two or more of something you know, have or are.
Microsoft Azure: Microsoft's public cloud platform offering compute, storage, networking, databases, AI, security and management services.
Microsoft Defender for Cloud: Azure's security posture management and threat protection service for Azure, hybrid and multi-cloud workloads.
Microsoft Entra Connect: Synchronises users and groups from on-premises Active Directory to Entra ID.
Microsoft Entra Domain Services: Managed domain join, Group Policy, LDAP and Kerberos/NTLM without managing domain controllers.
Microsoft Entra External ID (customers): Customer identity and access management for public-facing apps.
Microsoft Entra ID: Cloud identity and access management service (formerly Azure AD).
Middleware: Software between the OS and your app, such as web servers or database engines.
Multi-cloud: Using services from two or more public cloud providers.
Multi-tenancy: Many customers (tenants) share the same physical infrastructure while remaining logically isolated.
Network interface (NIC): Connects a VM to a virtual network subnet.
Non-regional service: A service that is always available across Azure geographies and is not tied to a region, such as Microsoft Entra ID.
Non-transitive: If A peers with B and B with C, A cannot reach C unless A and C are also peered (or a hub routes the traffic).
NSG: A set of allow and deny rules that filter network traffic to and from Azure resources.
On-demand self-service: You can create resources yourself in minutes through a portal or API, without raising a purchase order.
On-premises (on-prem): IT infrastructure owned and operated by the organisation itself, in its own building or a leased facility.
OpEx: Operational expenditure. Ongoing spending on services or products, expensed in the period it occurs.
Orchestration: Automatically deploying, scaling and healing many containers, for example with Kubernetes.
Orphaned resource: A resource left behind after its parent is deleted, such as a disk after a VM, which still costs money.
PaaS: Platform as a Service. The provider runs the OS, runtime and middleware; you deploy apps and manage data and access.
Passwordless: Signing in without a password, using biometrics, a device or a security key.
Pay-as-you-go: No commitment; pay the standard rate for usage, billed monthly.
Performance predictability: Confidence that the system will deliver a consistent user experience under expected load.
Perimeter layer: Protection at the edge of the network, such as DDoS protection and firewalls.
Physical security: Controls such as fences, guards, cameras and multi-step access checks that protect the building and hardware.
Point-to-site: Connects individual devices, such as a laptop, to Azure.
Policy definition: A rule describing a condition and an effect, such as "deny VMs outside allowed sizes".
Premium account: SSD-backed accounts for block blobs, file shares or page blobs that need low latency.
Pricing calculator: A web tool that estimates the cost of Azure services before deployment.
Priority: A number from 100 to 4096; lower numbers are processed first.
Private cloud: Cloud infrastructure dedicated to a single organisation, on-premises or hosted by a third party.
Private DNS zone: A DNS zone that resolves names only inside your virtual networks.
Private endpoint: A network interface with a private IP in your VNet that connects to a PaaS service.
Public cloud: Cloud services owned and run by a provider and available to any organisation or person over the internet.
Public endpoint: An internet-reachable address for a service.
Public preview: A service available to all customers for testing, usually without an SLA.
Queue Storage: Stores messages (up to 64 KB each) so app components can work asynchronously.
RA-: Read access to the secondary region at all times (RA-GRS, RA-GZRS).
Rack: A frame holding many servers and network switches inside a datacenter.
ReadOnly lock: Users can read a resource but cannot modify or delete it.
Redundancy: Running duplicate components so one failure does not take the service down.
Region: A geographic area with one or more datacenters networked together with low latency.
Region pair: Two regions in the same geography linked for resilience, with sequential updates and prioritised recovery.
Rehost / refactor / replace: Migration strategies that roughly map to IaaS (rehost), PaaS (refactor) and SaaS (replace).
Rehydration: Moving an archived blob back to an online tier so it can be read, which can take hours.
Reliability: The ability of a system to recover from failures and keep functioning correctly.
Remediation: Fixing existing non-compliant resources automatically.
Resource: A manageable item you create in Azure, such as a VM, storage account or web app.
Resource group: A logical container for resources that share a lifecycle, owner or purpose.
Resource Health: The current and past health of your individual resources.
Resource pooling: The provider shares huge pools of hardware between many customers, keeping each customer isolated.
Resource type: The kind of service and its settings, such as VM size, storage tier or redundancy.
Role definition: A collection of permissions, such as Reader or Contributor.
Root management group: The single top-level management group for a Microsoft Entra tenant.
Route-based VPN: Uses routes to decide which traffic goes into the tunnel; the most common and flexible type.
RPO: Recovery Point Objective. The maximum acceptable amount of data loss, measured in time.
RTO: Recovery Time Objective. The maximum acceptable time to restore service after a failure.
Runtime: The environment your code needs to run, such as .NET, Node.js, Java or Python.
SaaS: Software as a Service. A finished application delivered over the internet, fully run by the provider.
Scalability: The ability to increase or decrease resources to handle changes in workload.
Scale to zero: When nothing is happening, no instances run and (on consumption plans) you pay nothing for compute.
Scale-in rule: The rule that removes instances when demand drops, which is the part that saves money.
Scope: Where the access applies: management group, subscription, resource group or resource.
Secure score: A measurement of your security posture; higher is better.
Security IN the cloud: The customer's job, which covers data, identities, access, configuration and (in IaaS) the OS and apps.
Security OF the cloud: The provider's job, which covers physical facilities, hardware, the hypervisor and the provider's own services.
Security principal: A user, group, service principal or managed identity that receives access.
Security rule: A rule with priority, source, destination, port, protocol and action (allow or deny).
Self-service portal: A catalogue where internal teams request resources themselves, the "cloud-like" part of a private cloud.
Serverless: A model where the provider manages all infrastructure and scaling; you supply code or workflows triggered by events.
Service credit: A percentage of fees refunded when an SLA is missed.
Service endpoint URL: The address of each service, such as https://name.blob.core.windows.net.
Service Health: A personalised view of service issues, planned maintenance and advisories affecting your subscriptions.
Shared responsibility model: The division of security and operational duties between the cloud provider and the customer.
Signal: Information used in the decision, such as user, location, device, app or risk.
Single point of failure: Any component whose failure stops the whole system.
Single-tenant: Infrastructure serving only one customer, the opposite of multi-tenant.
Site-to-site: Connects an entire on-premises network to Azure.
SLA: A formal commitment to uptime or connectivity, with service credits if it is not met.
Sovereign region: An isolated instance of Azure for government or legal requirements, such as Azure Government or Azure in China.
Spot VMs: Unused Azure capacity at large discounts that Azure can evict when it needs the capacity back.
SQL Managed Instance: PaaS with near-100% SQL Server compatibility, ideal for lift-and-shift.
Standard general-purpose v2: The recommended account type, supporting blobs, files, queues and tables with all redundancy options.
Stateless: A function keeps no data between runs unless you store it elsewhere; Durable Functions adds stateful workflows.
Storage account: A uniquely named container for Azure Storage services and their settings.
Subnet: A segment of a VNet's address space used to group and isolate resources.
Subscription: A container for resources that is a billing boundary and an access control boundary.
Subscription licensing: Paying per user or per month for software instead of buying perpetual licences.
Table Storage: Schemaless NoSQL storage of structured key/attribute data.
Tag: A name-value pair of metadata on a resource.
Tag inheritance: Resources do not inherit tags from their group by default; Azure Policy can enforce or copy them.
TCO calculator: A tool comparing on-premises and Azure costs for a workload.
Tenant: A dedicated instance of Microsoft Entra ID representing an organisation.
Time to market: How long it takes to get a new product or feature in front of customers.
Total cost of ownership: All direct and indirect costs of a system over its lifetime.
Transit: Traffic passing through a hub between other networks, such as branch to branch.
Trigger: The event that starts a function, such as an HTTP call, a timer or a new blob.
Undifferentiated heavy lifting: Work that is necessary but does not make your product special, such as racking servers or patching hardware.
Update domain: A group of VMs that can be rebooted together during planned maintenance.
Uptime: The percentage of time a service is available.
Verify explicitly: Always authenticate and authorise using identity, location, device, service and risk.
Vertical scaling (scale up/down): Changing the size of a single resource, such as adding CPUs or memory to a VM.
Virtual machine: Software emulation of a physical computer with its own full OS (IaaS).
Virtual machine (VM): A software-based computer running on a physical host, with its own OS, CPU, memory and disks.
Virtual Machine Scale Set: A group of identical VMs that can scale automatically.
Virtual network (VNet): A logically isolated private network in Azure, scoped to one region.
Virtual WAN hub: A Microsoft-managed virtual network that acts as the central connection point in a region.
VM size: The amount of vCPU, memory and other capacity, such as Standard_B1s or Standard_D4s_v5.
VNet peering: A private connection between two virtual networks.
VPN gateway: A virtual network gateway that creates encrypted IPsec/IKE tunnels over the internet.
Web app: An App Service app that hosts a website or web API.
Web Application Firewall (WAF): Protects web apps from common attacks such as SQL injection and cross-site scripting.
Well-Architected Framework: Microsoft's best-practice guidance; Advisor's categories align with its pillars.
Windows multi-session: Windows 10/11 Enterprise editions that allow several users on one VM at once, available on Azure Virtual Desktop.
Zero Trust: A model where every access request is fully verified, regardless of where it comes from.
Zonal service: A resource pinned to a zone you choose, such as a VM in zone 1.
Zone-redundant service: A service Azure automatically replicates across zones, such as zone-redundant storage (ZRS).
ZRS: Zone-redundant storage. 3 copies across 3 availability zones.