Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AZ 900 Prep > Describe Azure Architecture And Services > Flashcards

Describe Azure Architecture And Services Flashcards

1
Q

What is an Azure Region?

A

A region is a geographical area that contains multiple datacenters that are nearby and networked together with a low-latency network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is an Availability zone?

A

Availability zones are physically separate datacenters within an Azure region connected together through high-speed, private fiber-optic networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are Azure region pairs

A

A region pair are azure region that are paired together

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are Azure region pairs

A

A region pair is an azure region that is paired together with another region within the same geography (such as US, Europe, or Asia) at least 300 miles away.

If a region in a pair was affected by a natural disaster, services would automatically fail over to the other region in its region pair.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What is a resource

A

A resource is an instance of azure services that you create e.g. VMs, storage account, app services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is a resource group?

A

Collection of resources grouped together.

  • When you apply an action to a resource group, that action will apply to all the resources within the resource group.
  • If you delete a resource group, all the resources will be deleted.
  • If you grant or deny access to a resource group, you’ve granted or denied access to all the resources within the resource group.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is a Subscription?

A

Container that is used to provision azure resources (VM, storage, network). The resources are used and billed as a group. An Azure subscription links to an Azure account which provides authentication.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the two types of subscription boundaries that you can have?

A
  • Billing boundary: This subscription type determines how an Azure account is billed for using Azure. You can create multiple subscriptions for different types of billing requirements. Azure generates separate billing reports and invoices for each subscription so that you can organize and manage costs.
  • Access control boundary: This billing model allows you to manage and control access to the resources that users provision with different subscriptions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is a management group

A

Management groupsallow you to organize your subscriptions and apply governance controls, such as Azure Policy and Role-Based Access Controls (RBAC), to the management groups. All subscriptions within a management group automatically inherit the controls applied to the management group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are Azure Virtual Machines?

A

Azure Virtual machines are used to create and use VMs in the cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are Azure Virtual machine scale sets?

A

Azure Virtual machine scale sets let you create, manage, configure and update a large group of identical load-balanced VMs. these VMs instances can increase/decrease to demand or scale based on a defined schedule

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are Azure Availability sets? (Update domain or fault domain?)

A

Azure Availability sets are used to stagger VM updates, they have varied power and network connectivity preventing you from losing all your VMs from a single network for power failure. This is done by grouping VMs in update domains or fault domains

Update domain: The update domain groups VMs that can be rebooted at the same time.

The fault domain groups your VMs by common power source and network switch.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is Azure Virtual Desktop?

A

Azure Virtual Desktop is a desktop and application virtualization service that runs on the cloud. It enables you to use a cloud-hosted version of Windows from any location

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are Azure containers?

A

Containers are a virtualization environment. Unlike virtual machines, you don’t manage the operating system for a container and you can run multiple operating systems on a single container.

VMs virtualise the hardware and Containers virtualise the operating system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What are Azure container instances?

A

Azure Container Instances are a platform as a service (PaaS) offering. Azure Container Instances allow you to upload your containers and then the service will run the containers for you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are Azure Functions?

A

Azure Functions is an event-driven, serverless compute option that doesn’t require maintaining virtual machines or containers. If you build an app using VMs or containers, those resources have to be “running” in order for your app to function. With Azure Functions, an event wakes the function, alleviating the need to keep resources provisioned when there are no events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is Azure App Service?

A

App Service is an HTTP-based hosting service that enables you to build and host web apps, background jobs, mobile back-ends, and RESTful APIs in the programming language of your choice without managing infrastructure. It offers automatic scaling and high availability. It supports Windows and Linux and enables automated deployments from GitHub, Azure DevOps, or any Git repo to support a continuous deployment model.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Give examples of app services?

A

Web apps
API jobs
WebJobs
Mobile apps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is Azure Virtual networks and virtual subnets?

A

Azure virtual networks and virtual subnets enable Azure resources, such as VMs, web apps, and databases, to communicate with each other, with users on the internet, and with your on-premises client computers.

Azure virtual networking supports both public and private endpoints to enable communication between external or internal resources with other internal resources.

  • Public endpoints have a public IP address and can be accessed from anywhere in the world.
  • Private endpoints exist within a virtual network and have a private IP address from within the address space of that virtual network.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What is a point-to-site virtual private network?

A

Point-to-site virtual private network connections are from a computer outside your organization back into your corporate network. In this case, the client computer initiates an encrypted VPN connection to connect to the Azure virtual network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is site-to-site virtual private networks?

A

Site-to-site virtual private networks link your on-premises VPN device or gateway to the Azure VPN gateway in a virtual network. In effect, the devices in Azure can appear as being on the local network. The connection is encrypted and works over the internet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is ExpressRoute?

A

Azure ExpressRoute provides a dedicated private connectivity to Azure that doesn’t travel over the internet. ExpressRoute is useful for environments where you need greater bandwidth and even higher levels of security.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is a VPN Gateway?

A

A VPN gateway is a type of virtual network gateway. Azure VPN Gateway instances are deployed in a dedicated subnet of the virtual network to enable connectivity. When you deploy a VPN Gateway, you specify the VPN type: policy-based or route-based

24
Q

What is a VPN?

A

A VPN establishes a secure, encrypted connection between your computer and the internet, providing a private tunnel for your data and communications while you use public networks.

25
Q

What is the difference between a policy-based or virtual-based VPN gateway?

A

Policy-based VPN gateways specify statically the IP address of packets that should be encrypted through each tunnel. This type of device evaluates every data packet against those sets of IP addresses to choose the tunnel where that packet is going to be sent through.

In Route-based gateways, IPSec tunnels are modeled as a network interface or virtual tunnel interface. IP routing (either static routes or dynamic routing protocols) decides which one of these tunnel interfaces to use when sending each packet. Route-based VPNs are the preferred connection method for on-premises devices

26
Q

What are the ExpressRoute connectivity model?

A

ExpressRoute supports four models that you can use to connect your on-premises network to the Microsoft cloud:

  • CloudExchange co- location
  • Point-to-point Ethernet connection
  • Any-to-any connection
  • Directly from ExpressRoute sites
27
Q

What is Azure DNS?

A

Azure DNS is a hosting service for DNS domains that provides name resolution by using Microsoft Azure infrastructure. By hosting your domains in Azure, you can manage your DNS records using the same credentials, APIs, tools, and billing as your other Azure services.

28
Q

What are Azure Files?

A

Offers fully managed cloud file shares that you can access from anywhere via the industry standardServer Message Block (SMB) protocol,Network File System (NFS) protocol, andAzure Files REST API.

You can mount Azure file shares from cloud or on-premises deployments of Windows, Linux, and macOS.
- when you want to lift and shift an application to the cloud
- when you want to replace the on-prem file servers

29
Q

What are Azure Blobs?

A

Allows unstructured data to be stored and accessed at a massive scale in block blobs.

  • to be able to access application data from anywhere
30
Q

What is Azure Elastic SAN?

A

Azure Elastic SAN (preview) is a fully integrated solution that simplifies deploying, scaling, managing, and configuring a SAN, while also offering built-in cloud capabilities like high availability.

31
Q

What are Azure Disks?

A

Allows data to be persistently stored and accessed from an attached virtual hard disk.

32
Q

What are Azure Queues?

A

Allows for asynchronous message queueing between application components.

33
Q

What are Azure Tables?

A

Allows you to store structured NoSQL data in the cloud, providing a key/attribute store with a schemaless design.

  • for storing flexible datasets like user data, address books
34
Q

What are Azure NetApps Files?

A

Offers a fully managed, highly available, enterprise-grade NAS service that can handle the most demanding, high-performance, low-latency workloads requiring advanced data management capabilities.

35
Q

Explain Azure storage redundancy?

A

Azure Storage always stores multiple copies of your data so that it’s protected from planned and unplanned events such as transient hardware failures, network or power outages, and natural disasters. Data in an Azure Storage account is always replicated three times in the primary region. Azure Storage offers two options for how your data is replicated in the primary region, locally redundant storage (LRS) and zone-redundant storage (ZRS).

36
Q

What is locally redundant storage?

A

Locally redundant storage (LRS) replicates your data three times within a single data center in the primary region. LRS provides at least 11 nines of durability (99.999999999%) of objects over a given year.

37
Q

What is zone-redundant storage?

A

zone-redundant storage (ZRS) replicates your Azure Storage data synchronously across three Azure availability zones in the primary region. ZRS offers durability for Azure Storage data objects of at least 12 nines (99.9999999999%) over a given year.

38
Q

What are the options for copying your data into a secondary region?

A
  • GRS copies your data synchronously three times within a single physical location in the primary region using LRS. It then copies your data asynchronously to a single physical location in the secondary region (the region pair) using LRS. GRS offers durability for Azure Storage data objects of at least 16 nines (99.99999999999999%) over a given year.
  • GZRS combines the high availability provided by redundancy across availability zones with protection from regional outages provided by geo-replication. Data in a GZRS storage account is copied across three Azure availability zones in the primary region (similar to ZRS) and is also replicated to a secondary geographic region, using LRS, for protection from regional disasters.
39
Q

What is Azure Migrate?

A

Azure Migrate is a service that helps you migrate from an on-premises environment to the cloud. Azure Migrate functions as a hub to help you manage the assessment and migration of your on-premises datacenter to Azure.

40
Q

Azure Data Box?

A

Azure Data Box is a physical migration service that helps transfer large amounts of data in a quick, inexpensive, and reliable way. The secure data transfer is accelerated by shipping you a proprietary Data Box storage device that has a maximum usable storage capacity of 80 terabytes.

Can be used for disaster recovery, Migrate back to on-premises or to another cloud service provider

41
Q

What is AzCopy?

A

AzCopy is a command-line utility that you can use to copy blobs or files to or from your storage account. With AzCopy, you can upload files, download files, copy files between storage accounts, and even synchronize files. AzCopy can even be configured to work with other cloud providers to help move files back and forth between clouds.

42
Q

What is Azure Storage Explorer?

A

Azure Storage Explorer is a standalone app that provides a graphical interface to manage files and blobs in your Azure Storage Account.

43
Q

What is Azure File Sync?

A

Azure File Sync is a tool that lets you centralize your file shares in Azure Files and keep the flexibility, performance, and compatibility of a Windows file server. It’s almost like turning your Windows file server into a miniature content delivery network. Once you install Azure File Sync on your local Windows server, it will automatically stay bi-directionally synced with your files in Azure.

44
Q

What is Azure Active Directory?

A

Azure Active Directory (Azure AD) is a directory service that enables you to sign in and access both Microsoft cloud applications and cloud applications that you develop. It provides authentication, single sign on and application and device management

45
Q

What is Single sign on?

A

Single sign-on (SSO) is an authentication method that allows users to sign in using one set of credentials to login across applications. For SSO to work, the different applications and providers must trust the initial authenticator. With SSO, you need to remember only one ID and one password.

46
Q

What is multi-factor authentication?

A
47
Q

What is Windows Hello for Business?

A

Windows Hello for Business is ideal for information workers that have their own designated Windows PC. The biometric and PIN credentials are directly tied to the user’s PC, which prevents access from anyone other than the owner. With public key infrastructure (PKI) integration and built-in support for single sign-on (SSO), Windows Hello for Business provides a convenient method for seamlessly accessing corporate resources on-premises and in the cloud.

48
Q

What is Microsoft Authenticator App?

A

The Microsoft Authenticator App turns any iOS or Android phone into a strong, passwordless credential.

49
Q

What are FID02 security keys?

A

Users can register and then select a FIDO2 security key at the sign-in interface as their main means of authentication. These FIDO2 security keys are typically USB devices, but could also use Bluetooth or NFC.

50
Q

What is conditional access in Azure AD?

A

Conditional Access is a tool that Azure Active Directory uses to allow (or deny) access to resources based on identity signals. It is used to provide access to resources based on organizational policies.

51
Q

What is role based access control?

A

The principle of least privilege says you should only grant access up to the level needed to complete a task. Azure RBAC uses an allow model.

52
Q

Describe zero trust model

A

Zero Trust is a security model that assumes the worst case scenario and protects resources with that expectation. Zero Trust assumes breach at the outset, and then verifies each request as though it originated from an uncontrolled network.

  • Verify explicitly- Always authenticate and authorize based on all available data points.
  • Use least privilege access- Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA), risk-based adaptive policies, and data protection.
  • Assume breach- Minimize blast radius and segment access. Verify end-to-end encryption. Use analytics to get visibility, drive threat detection, and improve defenses.
53
Q

Describe defense in depth

A

Each layer provides protection so that if one layer is breached, a subsequent layer is already in place to prevent further exposure. This approach removes reliance on any single layer of protection. It slows down an attack and provides alert information that security teams can act upon, either automatically or manually.

54
Q

Give a brief overview of each layer

A

Here’s a brief overview of the role of each layer:

  • The physical security layer is the first line of defense to protect computing hardware in the datacenter. Physical security mechanism
  • The identity and access layer controls access to infrastructure and change control. Use SSO and MFA
  • The perimeter layer uses distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users.
  • Use DDoS protection to filter large-scale attacks before they can affect the availability of a system for users.
  • Use perimeter firewalls to identify and alert on malicious attacks against your network.
  • The network layer limits communication between resources through segmentation and access controls.
  • Limit communication between resources.
  • Deny by default.
  • Restrict inbound internet access and limit outbound access where appropriate.
  • Implement secure connectivity to on-premises networks.
  • The compute layer secures access to virtual machines.
  • Secure access to VMs
  • Implement endpoint protection on devices and keep systems patched and current.
  • The application layer helps ensure that applications are secure and free of security vulnerabilities.
  • Ensure that applications are secure and free of vulnerabilities.
  • Store sensitive application secrets in a secure storage medium.
  • Make security a design requirement for all application development.
  • The data layer controls access to business and customer data that you need to protect.
  • Regulatory requirements dictate the controls and processes that must be in place to ensure the confidentiality, integrity, and availability of the data.
55
Q

Describe Microsoft defender for cloud

A

Defender for Cloud is a monitoring tool for security posture management and threat protection. It monitors your cloud, on-premises, hybrid, and multicloud environments to provide guidance and notifications aimed at strengthening your security posture.

AZ 900 Prep (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions