Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Az900 > Describe Azure architecture and services > Flashcards

Describe Azure architecture and services Flashcards

1
Q

What is Microsoft Azure?

A

Azure is a continually expanding set of cloud services that help you meet current and future business challenges. Azure gives you the freedom to build, manage, and deploy applications on a massive global network using your favorite tools and frameworks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Physical infrastructure

A

The physical infrastructure for Azure starts with datacenters. Conceptually, the datacenters are the same as large corporate datacenters. They’re facilities with resources arranged in racks, with dedicated power, cooling, and networking infrastructure.
Datacenters are grouped into Azure Regions or Azure Availability Zones that are designed to help you achieve resiliency and reliability for your business-critical workloads.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Regions

A

A region is a geographical area on the planet that contains at least one, but potentially multiple datacenters that are nearby and networked together with a low-latency network. Azure intelligently assigns and controls the resources within each region to ensure workloads are appropriately balanced.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Availability Zones

A
  • Availability zones are physically separate datacenters within an Azure region.
  • Each availability zone is made up of one or more datacenters equipped with independent power, cooling, and networking.
  • An availability zone is set up to be an isolation boundary. If one zone goes down, the other continues working.
  • Availability zones are connected through high-speed, private fiber-optic networks.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Availability Zones - Important

A

To ensure resiliency, a minimum of three separate availability zones are present in all availability zone-enabled regions. However, not all Azure Regions currently support availability zones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Azure services that support availability zones fall into three categories

A
  • Zonal services: You pin the resource to a specific zone (for example, VMs, managed disks, IP addresses).
  • Zone-redundant services: The platform replicates automatically across zones (for example, zone-redundant storage, SQL Database).
  • Non-regional services: Services are always available from Azure geographies and are resilient to zone-wide outages as well as region-wide outages.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Region pairs

A

Most Azure regions are paired with another region within the same geography (such as US, Europe, or Asia) at least 300 miles away.
This approach allows for the replication of resources across a geography that helps reduce the likelihood of interruptions because of events such as natural disasters, civil unrest, power outages, or physical network outages that affect an entire region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Sovereign Regions

A

Sovereign regions are instances of Azure that are isolated from the main instance of Azure. You may need to use a sovereign region for compliance or legal purposes.

Azure sovereign regions include:

  • US DoD Central, US Gov Virginia, US Gov Iowa
  • China East, China North, and more: These regions are available through a unique partnership between Microsoft and 21Vianet, whereby Microsoft doesn’t directly maintain the datacenters.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Azure resources

A

A resource is the basic building block of Azure. Anything you create, provision, deploy, etc. is a resource. Virtual Machines (VMs), virtual networks, databases, cognitive services, etc. are all considered resources within Azure.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Azure resource groups - definitions

A

Resource groups are simply groupings of resources.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Azure resource groups characteristics

A
  • When you create a resource, you’re required to place it into a resource group.
  • A single resource can only be in one resource group at a time.
  • Some resources may be moved between resource groups, but when you move a resource to a new group, it will no longer be associated with the former group.
  • Resource groups can’t be nested, meaning you can’t put resource group B inside of resource group A.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Azure resource groups - hiearchy

A

When you apply an action to a resource group, that action will apply to all the resources within the resource group. If you delete a resource group, all the resources will be deleted.
If you grant or deny access to a resource group, you’ve granted or denied access to all the resources within the resource group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Azure subscriptions - def

A

Subscriptions are a unit of management, billing, and scale. Similar to how resource groups are a way to logically organize resources, subscriptions allow you to logically organize your resource groups and facilitate billing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Azure subscriptions - characteristics

A
  • Using Azure requires an Azure subscription.
  • A subscription provides you with authenticated and authorized access to Azure products and services.
  • It also allows you to provision resources.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Azure subscriptions boundaries

A
  • Billing boundary: This subscription type determines how an Azure account is billed for using Azure.
  • Access control boundary: Azure applies access-management policies at the subscription level, and you can create separate subscriptions to reflect different organizational structures.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Azure management groups

A

Azure management groups provide a level of scope above subscriptions. You organize subscriptions into containers called management groups and apply governance conditions to the management groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Azure management groups - characteristics

A
  • All subscriptions within a management group automatically inherit the conditions applied to the management group, the same way that resource groups inherit settings from subscriptions and resources inherit from resource groups. - - Management groups give you enterprise-grade management at a large scale, no matter what type of subscriptions you might have.
  • Management groups can be nested.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Azure virtual machines

A

You can create and use VMs in the cloud. VMs provide infrastructure as a service (IaaS) in the form of a virtualized server and can be used in many ways.
Only 1 OS per VM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Virtual machine scale sets

A
  • Virtual machine scale sets let you create and manage a group of identical, load-balanced VMs.
  • Scale sets allow you to centrally manage, configure, and update a large number of VMs in minutes.
  • The number of VM instances can automatically increase or decrease in response to demand, or you can set it to scale based on a defined schedule.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Azure virtual desktop

A

Azure Virtual Desktop is a desktop and application virtualization service that runs on the cloud. It enables you to use a cloud-hosted version of Windows from any location. Azure Virtual Desktop works across devices and operating systems, and works with apps that you can use to access remote desktops or most modern browsers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Containers

A
  • Containers are a virtualization environment.
  • You can run multiple containers on a single physical or virtual host.
  • Containers are lightweight and designed to be created, scaled out, and stopped dynamically.
  • It’s possible to create and deploy virtual machines as application demand increases, but containers are a lighter weight, more agile method.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Azure Container Instances

A
  • Azure Container Instances offer the fastest and simplest way to run a container in Azure; without having to manage any virtual machines or adopt any additional services.
  • Azure Container Instances are a platform as a service (PaaS) offering.
  • Azure Container Instances allow you to upload your containers and then the service will run the containers for you.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Azure Container Apps

A
  • Azure Container Apps are similar in many ways to a container instance.
  • They allow you to get up and running right away, they remove the container management piece, and they’re a PaaS offering.
  • Container Apps have extra benefits such as the ability to incorporate load balancing and scaling. These other functions allow you to be more elastic in your design.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Azure Kubernetes Service

A

Azure Kubernetes Service (AKS) is a container orchestration service.
An orchestration service manages the lifecycle of containers.
When you’re deploying a fleet of containers, AKS can make fleet management simpler and more efficient.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Azure functions

A

Azure Functions is an event-driven, serverless compute option that doesn’t require maintaining virtual machines or containers.
With Azure Functions, an event wakes the function, alleviating the need to keep resources provisioned when there are no events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Azure functions - benefits

A
  • Functions scale automatically based on demand, so they may be a good choice when demand is variable.
  • Only charged for the CPU time used while your function runs.
  • Functions can be either stateless or stateful.
  • Flexibility
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Azure App Service

A

Azure App Service is an HTTP-based service for hosting web applications, REST APIs, and mobile back ends. It supports multiple languages, including .NET, .NET Core, Java, Ruby, Node.js, PHP, or Python. It also supports both Windows and Linux environments.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Azure App Service - Benefits

A

Handles most of the infrastructure decisions you deal with in hosting web-accessible apps:
- Deployment and management are integrated into the - platform.
- Endpoints can be secured.
- Sites can be scaled quickly to handle high traffic loads.
- The built-in load balancing and traffic manager provide high availability.

offers automatic scaling and high availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Azure virtual networking

A

Provide the following key networking capabilities:
- Isolation and segmentation
- Internet communications
- Communicate between Azure resources
- Communicate with on-premises resources
- Route network traffic
- Filter network traffic
- Connect virtual networks

30
Q

Azure virtual private networks

A

A virtual private network (VPN) uses an encrypted tunnel within another network.
VPNs are typically deployed to connect two or more trusted private networks to one another over an untrusted network (typically the public internet).
Traffic is encrypted while traveling over the untrusted network to prevent eavesdropping or other attacks.
VPNs can enable networks to safely and securely share sensitive information.

31
Q

VPN gateways

A

A VPN gateway is a type of virtual network gateway. Azure VPN Gateway instances are deployed in a dedicated subnet of the virtual network and enable the following connectivity:

  • Connect on-premises datacenters to virtual networks through a site-to-site connection.
  • Connect individual devices to virtual networks through a point-to-site connection.
  • Connect virtual networks to other virtual networks through a network-to-network connection.
32
Q

Types of VPN

A
  • Policy-based VPN gateways specify statically the IP address of packets that should be encrypted through each tunnel.
  • In Route-based gateways, IPSec tunnels are modeled as a network interface or virtual tunnel interface. IP routing (either static routes or dynamic routing protocols) decides which one of these tunnel interfaces to use when sending each packet.
33
Q

Use a route-based VPN gatewaywhen

A

Connections between virtual networks
Point-to-site connections
Multisite connections
Coexistence with an Azure ExpressRoute gateway

34
Q

Azure ExpressRoute

A

Azure ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection, with the help of a connectivity provider.
This connection is called an ExpressRoute Circuit. With ExpressRoute, you can establish connections to Microsoft cloud services, such as Microsoft Azure and Microsoft 365. This allows you to connect offices, datacenters, or other facilities to the Microsoft cloud. Each location would have its own ExpressRoute circuit.

35
Q

Features and benefits of ExpressRoute

A
  • Connectivity to Microsoft cloud services across all regions in the geopolitical region.
  • Global connectivity to Microsoft services across all regions with the ExpressRoute Global Reach.
  • Dynamic routing between your network and Microsoft via Border Gateway Protocol (BGP).
  • Built-in redundancy in every peering location for higher reliability.
36
Q

Azure DNS

A

Azure DNS is a hosting service for DNS domains that provides name resolution by using Microsoft Azure infrastructure. By hosting your domains in Azure, you can manage your DNS records using the same credentials, APIs, tools, and billing as your other Azure services.

37
Q

Benefits of Azure DNS

A

Reliability and performance
Security
Ease of Use
Customizable virtual networks
Alias records

38
Q

Virtual machine availability sets

A

Availability sets are designed to ensure that VMs stagger updates and have varied power and network connectivity, preventing you from losing all your VMs with a single network or power failure.

39
Q

Storage account type

A
  • Blob Storage
  • Data Lake Storage
  • Queue Storage
  • Table Storage
  • Azure Files
40
Q

Storage redundancy options

A

Locally redundant storage (LRS)
Geo-redundant storage (GRS)
Read-access geo-redundant storage (RA-GRS)
Zone-redundant storage (ZRS)
Geo-zone-redundant storage (GZRS)
Read-access geo-zone-redundant storage (RA-GZRS)

41
Q

Locally redundant storage

A

Locally redundant storage (LRS) replicates your data three times within a single data center in the primary region. LRS provides at least 11 nines of durability (99.999999999%) of objects over a given year.

42
Q

Zone-redundant storage

A

For Availability Zone-enabled Regions, zone-redundant storage (ZRS) replicates your Azure Storage data synchronously across three Azure availability zones in the primary region. ZRS offers durability for Azure Storage data objects of at least 12 nines (99.9999999999%) over a given year.

43
Q

Geo-redundant storage

A

GRS copies your data synchronously three times within a single physical location in the primary region using LRS. It then copies your data asynchronously to a single physical location in the secondary region (the region pair) using LRS. GRS offers durability for Azure Storage data objects of at least 16 nines (99.99999999999999%) over a given year.

44
Q

Geo-zone-redundant storage

A

GZRS combines the high availability provided by redundancy across availability zones with protection from regional outages provided by geo-replication.
Data in a GZRS storage account is copied across three Azure availability zones in the primary region (similar to ZRS) and is also replicated to a secondary geographic region, using LRS, for protection from regional disasters.

45
Q

Read access to data in the secondary region

A

Geo-redundant storage (with GRS or GZRS) replicates your data to another physical location in the secondary region to protect against regional outages. However, that data is available to be read only if the customer or Microsoft initiates a failover from the primary to secondary region. However, if you enable read access to the secondary region, your data is always available, even when the primary region is running optimally. For read access to the secondary region, enable read-access geo-redundant storage (RA-GRS) or read-access geo-zone-redundant storage (RA-GZRS).

46
Q

Benefits of Azure Storage

A
  • Durable and highly available
  • Secure.
  • Scalable.
  • Managed.
  • Accessible.
47
Q

Azure Blobs

A

Azure Blob storage is an object storage solution for the cloud. It can store massive amounts of data, such as text or binary data. Azure Blob storage is unstructured.
One advantage of blob storage over disk storage is that it doesn’t require developers to think about or manage disks. Data is uploaded as blobs, and Azure takes care of the physical storage needs.

48
Q

Blob storage tiers

A
  • Hot access tier: Accessed frequently
  • Cool access tier: stored for at least 30 days
  • Cold access tier: stored for at least 90 days.
  • Archive access tier: rarely accessed and stored for at least 180 days, with flexible latency requirements
49
Q

Azure Files

A

Azure File storage offers fully managed file shares in the cloud that are accessible via the industry standard Server Message Block (SMB) or Network File System (NFS) protocols.
Azure Files file shares can be mounted concurrently by cloud or on-premises deployments.
SMB Azure file shares are accessible from Windows, Linux, and macOS clients.
NFS Azure Files shares are accessible from Linux or macOS clients.

50
Q

Azure Files key benefits:

A

Shared access
Fully managed
Scripting and tooling
Resiliency
Familiar programmability

51
Q

Azure Queues

A

Azure Queue storage is a service for storing large numbers of messages. Once stored, you can access the messages from anywhere in the world via authenticated calls using HTTP or HTTPS. A queue can contain as many messages as your storage account has room for (potentially millions). Each individual message can be up to 64 KB in size. Queues are commonly used to create a backlog of work to process asynchronously.

52
Q

Azure Disks

A

Azure Disk storage, or Azure managed disks, are block-level storage volumes managed by Azure for use with Azure VMs.

53
Q

Azure Tables

A

Azure Table storage stores large amounts of structured data.

Azure tables are a NoSQL datastore that accepts authenticated calls from inside and outside the Azure cloud.

This enables you to use Azure tables to build your hybrid or multi-cloud solution and have your data always available. Azure tables are ideal for storing structured, non-relational data.

54
Q

Azure Migrate

A

Azure Migrate is a service that helps you migrate from an on-premises environment to the cloud. Azure Migrate functions as a hub to help you manage the assessment and migration of your on-premises datacenter to Azure. It provides the following:

Unified migration platform
Range of tools: A range of tools for assessment and migration.
Assessment and migration: In the Azure Migrate hub, you can assess and migrate your on-premises infrastructure to Azure.

55
Q

Integrated tools

A

Azure Migrate: Discovery and assessment
Azure Migrate: Server Migration
Data Migration Assistant
Azure Database Migration Service
Azure App Service migration assistant
Azure Data Box

56
Q

AzCopy

A

AzCopy is a command-line utility that you can use to copy blobs or files to or from your storage account.

57
Q

Azure Storage Explorer

A

Azure Storage Explorer is a standalone app that provides a graphical interface to manage files and blobs in your Azure Storage Account. It works on Windows, macOS, and Linux operating systems and uses AzCopy on the backend to perform all of the file and blob management tasks.

58
Q

Azure File Sync

A

Azure File Sync is a tool that lets you centralize your file shares in Azure Files and keep the flexibility, performance, and compatibility of a Windows file server. It’s almost like turning your Windows file server into a miniature content delivery network.

59
Q

Authentication - def

A

Process of establishing the identity of a person, service, or device. It requires the person, service, or device to provide some type of credential to prove who they are. Authentication is like presenting ID when you’re traveling. It doesn’t confirm that you’re ticketed, it just proves that you’re who you say you are.

60
Q

Azure authentication support method

A

standard passwords, single sign-on (SSO), multifactor authentication (MFA), and passwordless.

61
Q

Single sign-on (SSO)

A

enables a user to sign in one time and use that credential to access multiple resources and applications from different providers. For SSO to work, the different applications and providers must trust the initial authenticator.

62
Q

Multifactor authentication

A

Process of prompting a user for an extra form (or factor) of identification during the sign-in process. MFA helps protect against a password compromise in situations where the password was compromised but the second factor wasn’t.

63
Q

Passwordless authentication

A

Passwordless authentication needs to be set up on a device before it can work. For example, your computer is something you have. Once it’s been registered or enrolled, Azure now knows that it’s associated with you. Now that the computer is known, once you provide something you know or are (such as a PIN or fingerprint), you can be authenticated without using a password.

64
Q

Azure external identities

A

external users can “bring their own identities.”
The external user’s identity provider manages their identity, and you manage access to your apps with Microsoft Entra ID or Azure AD B2C to keep your resources protected.

65
Q

capabilities make up External Identities:

A

Business to business (B2B) collaboration
B2B direct connect
Microsoft Azure Active Directory business to customer (B2C)

66
Q

Azure conditional access

A

Conditional Access is a tool that Microsoft Entra ID uses to allow (or deny) access to resources based on identity signals. These signals include who the user is, where the user is, and what device the user is requesting access from.

67
Q

Azure role-based access control

A

Azure provides built-in roles that describe common access rules for cloud resources. You can also define your own roles. Each role has an associated set of access permissions that relate to that role. When you assign individuals or groups to one or more roles, they receive all the associated access permissions.

68
Q

zero trust model

A

Zero Trust is a security model that assumes the worst case scenario and protects resources with that expectation. Zero Trust assumes breach at the outset, and then verifies each request as though it originated from an uncontrolled network.

69
Q

guiding principles: of zero trust model

A
  • Verify explicitly - Always authenticate and authorize based on all available data points.
  • Use least privilege access - Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA), risk-based adaptive policies, and data protection.
  • Assume breach - Minimize blast radius and segment access. Verify end-to-end encryption. Use analytics to get visibility, drive threat detection, and improve defenses.
70
Q

Describe defense-in-depth

A

The objective of defense-in-depth is to protect information and prevent it from being stolen by those who aren’t authorized to access it.

A defense-in-depth strategy uses a series of mechanisms to slow the advance of an attack that aims at acquiring unauthorized access to data.

71
Q

Layers of defense-in-depth

A
  • Physical security layer is the first line of defense to protect computing hardware in the datacenter.
  • The identity and access layer controls access to infrastructure and change control.
  • The perimeter layer uses distributed denial of service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users.
  • The network layer limits communication between resources through segmentation and access controls.
  • The compute layer secures access to virtual machines.
  • The application layer helps ensure that applications are secure and free of security vulnerabilities.
  • The data layer controls access to business and customer data that you need to protect.
72
Q

Microsoft Defender for Cloud

A

Defender for Cloud is a monitoring tool for security posture management and threat protection. It monitors your cloud, on-premises, hybrid, and multi-cloud environments to provide guidance and notifications aimed at strengthening your security posture.

Defender for Cloud provides the tools needed to harden your resources, track your security posture, protect against cyber attacks, and streamline security management. Deployment of Defender for Cloud is easy, it’s already natively integrated to Azure.

Az900 (6 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions