Azure Fundamentals certification exam prep

AZ-900 exam focuses on the foundational knowledge of cloud services and how those services are provided with Microsoft Azure. The exam is intended for candidates who are just beginning to work with cloud-based solutions and services or are new to Azure. The skills measured in this exam are:

Describe cloud concepts (25–30%)
Describe Azure architecture and services (35–40%)
Describe Azure management and governance (30–35%)

Describe Cloud Concepts

Models and services

Shared responsibility Model, we notice that the CSP responsibility changes depending on the service used :

| | On-prem | iaas | paas | saas | | -------------- | ------- | ---- | ---- | ---- | | applications | 🟩 | 🟩 | 🟩 | | | data | 🟩 | 🟩 | 🟩 | | | runtime | 🟩 | 🟩 | | | | middleware | 🟩 | 🟩 | | | | os | 🟩 | 🟩 | | | | virtualization | 🟩 | | | | | servers | 🟩 | | | | | storage | 🟩 | | | | | networking | 🟩 | | | |

Cloud Computing

Cloud is a cost-effective, global, secure, scalable (elastic) and alway current solution.

Cloud models

Public cloud: taking advantage of the CSP features fully like scalability, agility, no maintenance (or low maintenance) and low skill requirement.
Private cloud: a self hosted cloud environment, which offers legacy support and granular control over components and compliance.
Hybrid cloud: Combines advantages from both private and public cloud and allowing you to run apps in the right location so the real advantage here is flexibility.

Cloud concepts

Scalability: the ability of a system to handle growth of users or work.
Elasticity: the ability of a system to automatically grow and shrink based on app demand.
Agility: the ability to react quickly to changes in demand, without manual intervention.
Economies of scale: the ability to achieve cost effective setups due to the scale a CSP like microsoft azure operates at.
CapEx: the upfront expenditure.
OpEx: is Billed as you go model which reduces CapEx.
Consumption based model: Pay for what you use model.
High-Availability and Fault tolerance: it’s between the ability to keep services up and running for long periods of time on component level failures.

Describe Core Azure Services

Core Architectural components

Azure geography:

Regions: a set of disaster deployed within a latency-defined perimeter and connected through a dedicated regional low latency network.
Region-pairs: a relationship between 2 azure regions within the same geographic region for disaster recovery purposes.
Availability zones: Unique physical locations within a region with independent power, network and cooling, comprises of one or more datacentres and is tolerant to data center failures via redundancy and isolation.

Logical components:

Management groups: provide a level of scope above subscriptions to combine the subscription into a single top-level management group called “root”.
Subscription: Logical container to provision resources in azure.
Resource groups: A container that holds related resources for an azure solution that share the same resource lifecycle.
Resources: An entity managed by azure, like virtual machine, virtual network or storage account.

Core azure services

Compute:

Azure VMs: compute-on-demand
App-service: HTTP based service for hosting web applications, REST APIs.
Azure container instance (ACI): Runs docker containers on-demand in a managed serverless azure environment for isolated containers without orchestration.
AKS: a hosted Kubernetes service, azure handles critical tasks like health monitoring and maintenance for you.
Windows virtual desktop: rdp for running windows 10 remotely.

Network:

Virtual network: A logical representation of your network in azure (VNET contains one or more subnets) provides a logical isolation dedicated to your subscription.
VPN gateway: a virtual network gateway that sends encrypted traffic between an Azure VNET and an on-premises location over the internet (hybrid-cloud concept).
VNET peering: enables seamless connection of two or more virtual networks in Azure.
Express Route: extends your on-premises networks into azure over a private connection with the help of a connectivity provider (ISP) (does not traverse the internet).

Storage:

Blob storage: Storage optimized for storing massive amounts of unstructured data
File storage: Fully managed files shares in azure accessible via SMB or NFS
Disk storage: Azure storage disks are block level storage volumes that are managed by azure and used with azure vms
Storage tiers: azure storage hot, cool and archive access tiers to store blob object data in a cost effective manner (you can use lifecycle management policies to automate tiers)
Table storage: a service that stores structured NoSQL data in azure, including a schema-less key/attribute store
Queue storage: a service for storing large numbers of messages, accessible from anywhere via authenticated HTTP or HTTPS calls

Databases:

Cosmos DB: a fully managed NoSQL database for modern app development, it features ultra-low response latency, and APIs for several popular languages and DB platforms [Fast, global access, data convergence]
MS SQL: a fully managed PaaS database engine that handles most management functions such as upgrading, patching, backups and monitoring
PostgreSQL: a relational database service in the microsoft cloud based on the compatibility community edition.
MySQL: a relational database service in the microsoft cloud based on the mysql community edition.
SQL managed instance: Cloud database service that combines the broadest SQL server database engine compatibility with all the benefits of a PaaS essentially considered in a scenario where you want to migrate on-premises DBs and concerned about compatibility.
azure marketplace has a catalog of over 17000 certified apps and services

Describe core solutions and management tools on azure

Core Solutions

IOT:

IoT hub: a central message hub for bi-directional communication between you IoT app and the devices it manages
IoT Central: an IoT application platform that simplifies the creation of IoT solutions, by reducing the burden and cost of IoT management operations, and development (a fully managed SaaS solution).
Azure sphere: a secure high-level application platform with built-in communication and security features for internet-connected devices, basically it’s a linux based OS and a cloud based security service that provides continuous, renewable security.

Data Warehouse:

Data lake: A technology that enables big data analytics and artificial intelligence, it provides cloud storage that is less expensive than relational database cloud storage, it stores, organizes and analyzes large volumes of structured and unstructured data from diverse sources.
Synapse Analytics: integrated analytics service that accelerates time to insight across data warehouses and big data systems.
HDInsight: a cloud distribution of Hadoop components that makes it easy, fast, cost-effective to process massive amounts of data supports many frameworks such as Hadoop, Spark, Hive, LLAP, Kafka, Storm…
Data-bricks: Analytics platform optimized for the Azure CSP it has 2 environments for developing data intensive applications (SQL analytics and Workspace).

Machine learning:

Azure machine learning: Cloud-based environment used to train, deploy, automate, manage and track ML models.
Cognitive services: Cloud-based services with REST APIs and client library SDKs available to help you build cognitive intelligence into your applications while also providing cognitive understanding (Vision, Speech, Language, Decision and Search).
Azure Bot Service: a managed bot development service that provides an integrated environment for a purpose-built bot development and helps you easily connect to your users via popular channels.

Serverless:

Logic app: a cloud service that helps you schedule, automate and orchestrate tasks, business processes and workflows (there’s a gallery of pre-built connectors you can use for MSFT & 3rd party services).
Functions: an event driven, compute-on-demand experience that extends the existing azure application platform with capabilities to implement code triggered by event occurring in Azure as well as on-prem systems.
Event Grid: enables management of events across many different azure services and applications (push events to the configured destination).

Difference between PaaS and Serverless:

DevSecOps:

Azure DevSecOps: a single platform for implementing DevSecOps, deploying code using the CI/CD framework, facilitating Agile software development.
GitHub: a web-based git repository hosting service for Source code management and distributed revision control.
GitHub Actions: Helps you automate software development workflows from within GitHub (Build-test-package-release-deploy any project with a workflow).
Azure DevTest Labs: a self-service sandbox environment to quickly create Dev/Test environments while minimizing waste and controlling costs.

Management:

Azure Portal, Azure cloud shell, Azure powershell, Azure CLI, Azure advisor (security and cost optimization on present deployment), ARM templates (JSON description for deployment), Azure monitor and azure service health.

Describe general security and network security features

Azure security features

Azure security center: A unified infrastructure security management system that strengthens the security posture of your data centers (cloud/on-prem).
keyvault: A cloud service for securely storing and accessing secrets, anything that you want to tightly control access to, such as API keys, passwords, certificates or cryptographic keys.
Azure sentinel: A cloud-native, security information event management “SIEM” and security orchestration automated response “SOAR” solution.
Dedicated Hosts: A service that provides dedicated physical servers able to host one or more virtual machines in one Azure subscription.

Azure network security

Defense in-depth: A layered (defense in depth) approach that does not rely n one method to completely protect your environment.
Network security group: Contains security rules that allow or deny inbound network traffic to, or outbound traffic from, several types of azure resources. For each rule, you can specify source and destination, port, and protocol.
Azure Firewall: A managed, cloud-based network security service that protects your azure virtual network resources. A fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability.
Azure DDoS: Standard tier provides enhanced DDoS mitigation features to defend against DDos Attacks. Also includes logging, alerting and telemetry not included in the free basic tier present by default.

Describe identity, governance, privacy and compliance features

Describe Core Azure identity services

Authentification and authorization: AuthN is the process of proving that you are who you say you are. AuthZ is the act of granting an authenticated party permission to do something.
Azure AD: It’s a microsoft cloud based identity and access management service… which helps with employee sign in and access to resources:

internal resources, such as apps on your corporate network or custom cloud apps.
External resources, such as Microsoft 365, the azure portal, and many SaaS apps.

SSO: A single sign on means a user doesn’t have to sign into every application they use. The user logs in once and that credential is used for multiple apps. (Modern authN)
MFA: Azure AD MFA works by requiring two or more of the following authN methods :

Something you know (pin/password)
something you have (trusted device)
something you are (biometric)

Conditional Access: used by Azure AD to bring signals together, to make decisions, and enforce organizational policies.

Describe Azure Governance features

RBAC: Azure RBAC helps you manage who has access to azure resources what they can do with those resources, and which resources/areas they have access to.
Resource Locks: Prevent other users in your organization from accidentally deleting or modifying critical resources. The overrides any permissions the user might have.
Basics of Governance:

Policy: the definition of the conditions which you want to control/govern.
Initiative: A collection of azure policy definitions that are grouped together towards a specific goal.
Blueprint: A container for composing sets of standards, patterns and requirements for implementation of azure cloud services, security and design.

Tags: A name and a value pair used to logically organize azure resources, resource groups and subscriptions into a logical taxonomy. considered basis of applying business policies or tracking costs.

Describe privacy and compliance resources

Security privacy and compliance: s- Protecting the data that’s entrusted to microsoft by using strong encryption and access controls. p- Privacy is about making meaningful choices for how and why data is collected and used. c- Compliance with regulations is critical and microsoft aims to ease this task for azure customers.
OST: Contains all the terms and conditions for software and online services through microsoft commercial licensing programs.
DPA: Further defines the data processing and security terms for online services, including data compliance, disclosure, security, transfer and retention.
Trust center: teaches about the four foundational principles of trust: security privacy compliance and transparency.
Azure sovereign regions: Special regions that you might need for compliance or legal purposes: Government, China, Germany.

Describe Azure cost management and Service Level Agreement

Affect costs

Factors that can affect azure resource costs include resource types, services, locations, ingress and egress traffic.

Reduce costs

Factors that can reduce costs include reserved instances, reserved capacity, hybrid use benefit, spot pricing. Reserved instances: concerns only virtual machines and long term commitment (1yr-3yr) Reserved Capacity: Achieve significant savings on Azure SQL Database, Azure cosmos DB and Azure Synapse analytics and azure cache for redis. Enables cost management across predictable and variable workloads and helps budget optimization. Hybrid use benefit: Let’s you use your on-premises software assurance-enabled windows server and SQL server licenses on Azure. Spot pricing: Access unused Azure compute capacity at deep discounts up to 90% compared to Pay-as-you go prices.

Pricing calculator

Interactive calculator that allows you to estimate Azure resource costs. Enables you to choose region, instance, tiers, etc…to match functionality and budget needs. Azure cost management: A suite of tools provided by Microsoft that help you analyze, manage and optimize the costs of your workloads.

SLA and service life cycles

Azure SLAs: To provide a clear explanation of availability (and sometimes performance) of an azure service. Actions that can affect an SLA: Failing to deploy a service in a manner that meets the SLA requirements. Service Lifecycle: Private preview: Open only to companies or users invited for evaluation. Public preview: Open to public, but preview limitations still apply. General Availability: Considered as production ready.