Azure Fundamentals AZ-900

You can use Azure Resource Manager templates to automate the creation of the Azure resources. Deploying resource through templates is known as 'Infrastructure as code'.

A resource group is a logical container for Azure resources. With a resource group, you can allow a user to manage all resources in the resource group.

Resource groups are used for grouping of resources. To define requirements for resource properties Azure policies are needed.

Azure CLI allows you to use the Bash shell to perform administrative tasks. Bash is used in Linux environments, so a Linux administrator will probably be more comfortable performing command-line administration from Azure CLI.

aaS is suitable for moving legacy applications to the cloud, as it provides the underlying infrastructure (virtual machines, storage, networks, etc.) that you can configure to run your existing applications without needing to make significant changes to the application's architecture.

You are not charged for user accounts.

You are not charged for Azure AD Groups.

An administrative unit in Azure Active Directory (Azure AD) is a resource that can act as a container for other Azure AD resources. It can contain only users, groups, or devices. Purpose: Administrative units are designed to restrict permissions in a role to specific portions of an organization

Operating systems are managed by customers when using IaaS or an on-premises deployments. The operating systems are not accessible in PaaS and SaaS deployments.

Azure Advisor analyzes the account usage and makes recommendations based on its set and configured rules.

Each Azure region is always paired with another region within the same geography, such as US, Europe, or Asia, at least 300 miles away.

IaaS consists of virtual machines and networking provided by the cloud provider. The customer is responsible for the OS and applications. The cloud provider is responsible for the OS in PaaS and SaaS.

ExpressRoute connections and Azure VPN Gateway are two services that you can use to connect an on-premises network to Azure. Bastion provides a web interface to remotely administer Azure virtual machines by using SSH/RDP. Azure Firewall is a stateful firewall service used to protect virtual networks.

When using Azure Key Vault, server applications don't need to store security information.

Vertical scaling keeps the number of resources constant, but gives those resources more capacity in terms of memory, CPU speed, disk space and network.

SaaS provides a complete software solution. All of the underlying infrastructure, middleware, software and database are located in the cloud.

The service provider manages the hardware and software and ensures the high availability of the system.

Resources are combined into resource groups, which act as a logical container into which Azure resources like web apps, databases, and storage accounts, are deployed and managed.

Azure Site Recovery helps ensure business continuity by keeping business apps and workloads running during outages. Site Recovery replicates workloads running on physical and virtual machines (VMs) from a primary site to a secondary location.

Availability zones are physically separate datacenters within an Azure region. Each availability zone is made up of one or more datacenters equipped with independent power, cooling, and networking.

Containers are a virtualization environment. Much like running multiple virtual machines on a single physical host, you can run multiple containers on a single physical or virtual host. Unlike virtual machines, you do not manage the operating system for a container.

Virtual Machine Scale Sets are an Azure compute resource that you can use to deploy and manage and scale a set of identical virtual machines.

Azure Advisor evaluates Azure resources and makes recommendations to help improve reliability, security, and performance, achieve operational excellence, and reduce costs.

The main features of Azure Resource Manager (ARM) are:

Health advisories are issues that require that you take proactive action to avoid service interruptions, such as service retirements and breaking changes. Service issues are problems such as outages that require immediate actions.

An Azure RBAC role is applied to a scope, which is a resource or set of resources that the access applies to. Resource locks prevent the accidental change or deletion of a resource. Resource tags are used to locate and act on resources associated with specific workloads, environments, business units, and owners. Policies enforce different rules across resource configurations so that the configurations stay compliant with corporate standards.

The two actions that can be performed using the Azure portal are:

• Create new resources: The Azure portal provides a graphical user interface for creating various Azure resources, such as virtual machines, storage accounts, databases, web apps, and more. You can easily navigate through the portal, select the resource type you want to create, and fill in the required configuration details.

• Assign deny permission on a resource group: Azure portal allows you to manage access control for your resources using Role-Based Access Control (RBAC). You can assign specific roles to users or groups, granting or denying them permissions to perform actions on resources within a resource group.

The other options are not entirely accurate:

• Change the availability zone of a virtual machine: While you can manage some aspects of virtual machines in the Azure portal, changing the availability zone usually requires more complex operations, like redeployment or using tools like Azure Resource Mover.
• Create Microsoft Entra user: Microsoft Entra (formerly Azure Active Directory) user management is typically done through the Microsoft Entra admin center, a separate portal dedicated to identity and access management.

You can assign a policy to any scope that you have access to, such as a management group, subscription, or resource group. However, you cannot assign a policy directly to an individual resource.

You can assign a lock on every Azure resource that you have access to. You can apply a lock at different levels of scope: subscription, resource group, or individual resource.

A hybrid cloud is a computing environment that combines a public cloud and a private cloud by allowing data and applications to be shared between them.

Cloud Shell is an interactive, browser-accessible shell for managing Azure resources.

Cloud computing allows you to scale more quickly. Owning your own CPUs and having full access in the event of an internet outage are not features of cloud computing. Working from multiple workstations is not specific to cloud computing compared to an on-premises deployment.

A network security group (NSG) works like a firewall. You can attach a NSG to a virtual network and/or individual subnets within the virtual network.

You can filter netowork traffic to and from Azure resources in an Azure virtual network with a NSG.

Azure App Service is a PaaS. However, Azure Storage Accounts are an IaaS, therefore this solution does not meet the goal.

A User Defined Route (UDR) in Azure can control network traffic not only within a single Virtual Network (VNet) but also between different subnets, VNets (through VNet peering), and even to on-premises networks if connected via VPN or ExpressRoute. UDRs provide a way to define how traffic is routed in the network, offering flexibility beyond the default system routes Azure provides.