Azure Achitecture and Services 2.2 Flashcards
Compute and Networking
Azure VMs
Server virtualization (compute)
on-demand without need for hardware purchase
Virtual machine
scale sets
Allow you to create and manage a group of
identical, load-balanced VMs.
The number of VM instances can automatically
increase or decrease in response to demand or
based on a schedule.
Focus = scale (scalability, capacity)
Virtual machine
availability sets
Help build a more resilient, highly available
environment by staggering VM updates and
ensuring varied power and network connectivity.
Focus = resiliency (availability)
Virtual machine
availability sets
They do this through two mechanisms:
FAULT DOMAINS and UPDATE DOMAINS.
Update Domains
Allows you to apply updates while knowing
that only one update domain grouping will
be offline at a time.
Fault Domains
Groups your VMs by common power source
and network switch.
By default, an availability set will split your VMs
across up to three fault domains.
Azure Virtual Desktop
A desktop and app virtualization
service that runs in Microsoft Azure.
Enable IT Pros and MSPs to create Windows
10 & 11 virtual desktops in Azure.
Azure Container Instance (ACI)
Runs Docker containers on-demand in a
managed, serverless Azure environment.
A solution for any scenario that can operate
in isolated containers, without orchestration.
Azure Kubernetes Services (AKS)
A hosted Kubernetes service, where
Azure handles critical tasks like health
monitoring and maintenance for you.
You pay only for the agent nodes within
your clusters, not for the masters (free tier).
For a financially backed SLA, you pay a few
cents per hour for cluster management.
VM Resource Requirements
Virtual Disk
Virtual Network (VNET)
Network Interface (Virtual NIC)
Network Security Group
Public IP Address
App Service
An HTTP-based service for hosting
web applications, REST APIs, and mobile back ends.
App Service Types
Web apps
API apps
Web jobs
Mobile apps
App Service Web apps
Using ASP.NET, ASP.NET
Core, Java, Ruby, Node.js,
PHP, or Python.
Run on Windows or Linux as
host OS
App Service API apps
Build REST-based web APIs
by using your choice of
language and framework.
Full Swagger support and
publish to Azure Marketplace.
App Service Web jobs
Run a program (.exe, Java, PHP,
Python, or Node.js) or script
(.cmd, .bat, PowerShell, or Bash)
in the same context as a web
app, API app, or mobile app.
Can be scheduled or run by a
trigger.
Often used to run background
tasks as part of your application
logic.
App Service Mobile apps
Used to quickly build a back end
for iOS and Android apps.
Enables auth with social identity
providers, send push notifications,
and execute backend logic.
Virtual Network VNET
A logical representation of your network in Azure.
A VNET contains one or more SUBNETS.
VNETs provide logical isolation in
Azure dedicated to your subscription.
Virtual Network VNET benefits
Create a dedicated private cloud-only network.
Securely extend your data center (Site-to-Site VPN).
Enable hybrid cloud scenarios.
Virtual Network VNET Rule
VMs in different VNETS cannot communicate by default
Virtual Subnet
Segment address space of VNET to create sub-networks.
Allows Azure resource deployment into a specific subnet.
Can affect outbound access and routing traffic between resources.
Virtual Subnet Rule
VMs in different subnets within a VNET can communicate by default!
VPN Gateway
Core component of “hybrid cloud”
A virtual network gateway that sends encrypted traffic between an Azure VNET and
an on-premises location over the Internet.
VPN Rule
site-to-site VPN traffic traverses the Internet
VNET Peering
Enables seamless connection of two or more Virtual Networks in Azure.
The two networks function as one in terms of connectivity.
ExpressRoute
Extends your on-premises networks into
Azure over a private connection with
the help of a connectivity provider
ExpressRoute Rule
traffic does NOT traverse the Internet
Azure DNS
a hosting service for DNS domains that
provides name resolution by using
Microsoft Azure infrastructure.
Can provide internal and external DNS.
Service Endpoint
Provides a way to lock down access to all instances of a PaaS
service to a VNET.
Accessible from public Internet
Private Endpoint
Grants access to a specific instance (resource) of a PaaS service in your VNET
on a private IP address.
Enables access from on premises without public endpoint
Defense in-Depth
A layered (defense in depth) approach that does not rely on one method to completely protect your environment.
Network Security Group
Contains security rules that allow or deny
inbound network traffic to, or outbound network
traffic from, several types of Azure resources.
For each rule, you can specify source and
destination port and protocol.
Can be applied to a subnet or network adapter.
Azure Firewall
A managed, cloud-based network security
service that protects your Azure Virtual Network resources.
It’s a fully stateful firewall as a service with
built-in high availability and unrestricted
cloud scalability.
Azure DDoS
Standard tier provides enhanced DDoS mitigation
features to defend against DDoS attacks.
Also includes logging, alerting, and telemetry not
included in the free Basic tier present by default.
