AZ-900 study notes

Storage

• Blob storage is a flat structure used for unstructured data (images, videos etc) and is normally used for large objects.
• Azure file storage and Azure Data Lake storage are hierarchical file storage similar to SMB shares, both of which you can do shares on
• Azure Queue Storage, A data store for queuing and reliably delivering messages between applications
• Azure Table Storage, Table storage is a server that stores non-relational structured data (also known as structured NoSQL data) in the cloud, providing a key/attribute store with schemaless design.
• LRS = Always 3 copies of the data but always in the same building
• ZRS = Always 3 copies of the data in the but in different zones
• GRS = Always 3 copies of the data, 3 in the primary region then 3 in another region
• GZRS = Always 3 copies of the data in the primary region over different zones then the same at the secondary region
• Premium only allows LRS and ZRS
• Azure File Sync allows you to sync on prem servers with an Azure share, the on prem servers never sync with each other, they all sync to the Azure share
• Azure File Sync you can add up to 100 on prem servers
• Azure Storage Explorer is a Windows app which allows you to browse Azure storage
• Azure Storage Browser is a Azure Portal that allows you to browse Azure storage.
• A storage account lives in a specific region
• A storage account comes in Std (general purpose v2) and prem (blobblocks, file shares, page blobs)
• Blob storage unstructured data types are adlgen2, hierarchical, page, page file storage)
• File storage types are smb/nfs shares
• Archive storage is offline, you will need to move the data to cold or hot to interact with it
• BLOB = Binary Large Object

Connectivity/Networking

• Azure Express route is more expensive than a site to site VPN
• You can also have a private connection to Azure via a Meet me
• Azure Express route does not traverse the internet, it's a private connection
• One vnet cannot talk to another vnet unless you create a vnet peer. The peer can span regions and subscriptions.
• For a site to site vpn the "Local Network Gateway" is created in Azure but it refers to the IP address of the on prem router/VPN. The "Virtual Network Gateway" is also created in Azure but this refers to the Azure side of the VPN
• By default all virtual machines get outbound traffic to the internet
• You can divide a vnet up in to subnets and configure routes between them
• If you want inbound traffic from the internet to a vm you must assign a public IP to the vm
• Azure Load Balancer, balances inbound and outbound connections to applications or service endpoints
• Azure Application Gateway, optimizes app server farm delivery whilst increasing application security
• Policy based VPN does not support point to point VPN
• You always lose 5 IP addresses when you create a submet, Azure uses these for gateways, dns etc
• Subnets/vnets cannot span subscriptions
• Azure Traffic Manager can create copies of a website around the world in different regions so it servers the customer from the closest one to them speeding up response and giving them a better experience.
• Outbound data transfer rates vary slightly based on the zone
• You can only have one local network gateway per vnet
• Point to point VPN only supports route based routing not policy based.
• You can configure access from vnet to vnet via NSG providing there is a peer
• The NSG needs to be in the same subscription and region of the subnet
• NSG is dest/soure, ip, port, protocol allow or deny
• WIth NSG you can create rules based on the service tags I.E Azure storage account as it has multiple IPs you could just use 1 tag
• You can apply a NSG to a subnet or a network interface but at the interface level its harder to manage.

Subscriptions

• One subscription can have a max of 980 resource groups
• One subscription can have a max of 50 tags
• A subscription is a collection of resources

Azure Migrate

Azure Migrate discovers on prem servers both physical and virtual and also both on Hyper-V and vmWare, it then assess the machine and tells you if its ready to migrate to Azure.

It will tell you how big the vm will be, how much it will cost and any other dependent servers that will also need to be migrated.

It will also help you migrate SQL Servers, WebApps, Desktops and data.

Azure Container Instance

Allows you to run a container with a single command.

Azure Kubernetes

• Allows you to run multiple containers which is known as a container orchestrator
• Azure Kubernetes Service, Cluster management for VMs that run containerized services.

Azure Functions

• This is a serverless event driven offering, allowing for individual functions to run and you only pay for it when it gets used.
• Azure Functions run off code so you will need to write code to create the function
• Azure Functions are stateless

Billing

• A billing account is an agreement between you and Mircosoft that you are using Azure Services.
• CAPEX - Purchasing something up front, this normally refers to an on prem solution
• OPPEX - Purchasing resources or services as we use it, this normally refers to a cloud offering
• Azure Cost Management allows for cost analysis, budgets, alerts and recommendations you must have a Enterprise agreement

Regions

• A region that supports availability zones has at least 3 datacenters, each datacenter is known as a zone.
• When viewing the Microsoft datacenter location map, if it has a diamond on it then that means it supports availability zones.
• All regions that support availability zones will see a min of 3 zones
• Zone redundant will distribute whatever you are deploying over zones automatically to ensure it is resilliant

Cloudshell

• Cloudshell supports both powershell and bash
• The first time you run CloudShell it will ask you for permission to create a storage account that the CloudShell vm can us

Microsoft Defender For Cloud

• Previously known as Azure Security Center

Azure DataBox

These are basically a box (nas box) that gets sent to you, you copy your data to it and send it back to Azure and they ingest it in to Azure.

The sizes are:

• Azure Data box Disk = 8tb
• Azure data box = 80tb
• Azure data box heavy = 770tb

Management

• Every tennant has a root management level, you can add 6 levels of groups under this
• Management groups help to manage groups of subscriptions
• Multiple subscriptions can be put in a management group

Azure Monitor

• Azure Monitor is a collection of monitoring tools to keep an eye on everything.
• You can create alert rules for example when storage is running low then you can use an Action Rule to do something like send an email or sms etc

Azure Service Health

• This is in the Portal under Help & Support. It shows you health issues with Azure, upcoming maint work. You can also setup alerts to notify you if there are issues with things that will affect things you are running.

Azure Logic Apps

• Low or no code required
• These do something based on a trigger. So for example if a file is uploaded or a web request received it will do something. No code is required for this, its a logic drag and drop interface.

Availability Zones

• When deploying a vm in to an availability zone ensure each vm is in a different zone number

Azure Devops

• Helps devops build, test, create environments.
• Azure Pipelines allows you to create continuous workflows to build, test and deploy code.
• Azure dev test labs allows you to spin up dev non prod environments, it allows admins to control costs by setting limits on how many vms can be deployed at once and ensuring vms are shut down when not in use.
• Free private Git repositories, configurable Kanban boards and extensive automated cloud based load testing
• Formally known as Visual Studio Team Services
• Azure DevTest Labs, quickly create on demand Windows and Linux environments to test or demo applications directly from deployment pipelines

Azure IoT

• Azure IoT central allows you to connect to thermostats, alarms etc. It is a fully managed sas solution. It allows you to create IoT applications without writing any code. It allows you to connect, monitor and manage IoT. This also has dashboards that can be customised.
• IoT Hub allows you to integrate your applications with devices, this is where the IoT devices connect in via. It provides secure communications between millions of IoT devices.
• Azure Sphere makes your IoT devices more secure. Which includes certified chips, Azure sphere operating system and Azure sphere security service which adds a layer of security to IoT devices. Sphere prevents bad things being sent to IoT devices and vice versa.
• IoT Edge is a fully managed service that allows data analysis models to be pushed directly onto IoT devices, which allows them to react quickly to state changes without needing to consult cloud based AI models

Azure backup

• Azure backup can backup both Azure and on prem machine

Azure Advisor

• Azure Advisor can suggest how to improve, solution and reduce cost on your environment. For example point out over provisioned machines and suggest a smaller more cost effective machine, it also suggests security recommendations.

Analytics

• Azure HDInsight is older, supports haddop, spark, hive and storm)
• Azure DataBricks is more user friendly and easier to manage than HDInsights and Azure Synapse Analytics. It supports all previously supported version but also Spark
• Azure Synapse Analytics, Fully managed data warehouse with integral security at every level of scale at no extra cost. This brings all the data factory stuff in to one workplace. This brings data warehousing and big data analytics together
• Azure data factory is what orchestrates the data lake services.

Azure CDN

• Azure CDN caches most freq content around the world so users will get it from the nearest server to them

Databases

• Azure Cosmos DB, globally distributed database that supports NoSQL option
• Azure SQL Database, fully managed relational database with auto-scale, integral intelligence and robust security
• Azure Database for MySQL, fully managed and scabled MySQL, relational database with high availability and security
• Azure database for PostgreSQL, fully managed and scalable PostgreSQL relational database with high availability and security
• SQL Server on Azure Virtual machines, service that hosts enterprise SQL server apps in the cloud
• Azure Database Migration Service, a service that migrates database to the cloud with no application code changes
• Azure Database for MariaDB, fully managed and scalable MariaDB relational database with high availability and security
• MongoDB and Cassandra both has a key value pair
• MongoDB and Cassandra can span multiple regions and able to store json docs

Shared responsibility Model

• IAAS, storage, network, computer and hypervisor is all looked after by the provider (azure) os runtime and application layer is down to the customer
• PAAS, Customer is just responsible for the application and data
• SAAS, for example something like office365, no exchange servers or exchange just the email service. This is all down to the provider.

Azure DDos Protection

• Protects Azure hosted application from distributed denial of server attacks
• Everything by default is protected by basic DDoS protection but it's more to protect Azure than you
• Standard DDoS plan can be linked to vnets and uses machine learning to tune to learn your normal interaction, it also gives metrics and reporting
• Rapid response means you can talk to a human in an attack and if it doesnt protect you I.E scaled up vms you can get credits
• Azure standard DDoS cannot be used over multiple subscriptions

Azure Network Watcher

• Monitors and diagnoses network issues by using scenario based analysis

Azure Firewall

• Implements high security, high availability firewall with unlimited scalability
• Auto scales bas on the demand it needs
• Understands layer 4 and layer 7
• Deploys in to it's own subnet
• All other subnets are configured to go via the firewall as its first hop using user defined routes
• Had app rules like url, fqdn and catagories)
• You can have network rules like NSG
• Premium SKU allows you to do TLS inspection
• It can do DNAT rules
• It uses vm scale sets behind the scenes

AI

• Azure Machine Learning Service, allows you to develop, train, test, deploy, manage and track machine learning models. It can auto generate a model and auto tune it for you. You can start on your local machine then scale out to the cloud.
• Azure ML Studio, Collaborative visual workspace where you can build and deploy machine learning solutions by using prebuilt machine learning algorithms and data handling models.

Azure Policy

• A policy can be created on a resource group to limit things like "You can only deploy stuff in XXX region, budget etc etc"
• You can create initiatives which is a collection of multiple polices, you then apply the initiative to something/

Azure Blueprints

• Allows you to deploy an entire environment, a blueprint is a collection of arm templates plus permissions.
• Azure Blueprints allows you to define a repeatable set of governance tools and standard Azure resources that your organisation requires.

A blueprint is a collection of:

• Resource group(s)
• Arm template
• RBAC
• Policy which is assigned to a subscription

Azure App Service

• Quickly create powerful cloud web based apps
• App service free and shared means sharing resources with other customers

Azure Notification Hub

Send push notifications to any platform from any back end

Azure API Management

Publish APIs to developers, partners and employees security and at scale

Azure Cognitive Search

• Fully managed search as a service

Serverless

• Also known Functions or Logic Apps. A function could be used to run a scheduled PowerShell script of some other code and you would just pay for when it ran. A Logic app requires no coding just a user friendly interface with pre made functions.

AI

• Azure Cognitive services, pre built AI bots
• Azure Bot Server, build virtual agent

Scalability vs Elasticity

Scalable environments only care about increasing capacity to accommodate an increasing workload. Elastic environments care about being able to meet current demands without under/over provisioning, in an autonomic fashion.

Scalability will scale up if needed but you will be left with the addition resource is load reduces where as Elasticity will both scale up and down based on load.

Azure Key Vault

Azure Key Vault supports 3 different types of identity:

• Secrert (read/write) like a password or share signature
• Keys (generate and import but cannot export)
• Cert (life cycle management and distribution)

You can fun all of these on top of HSMs

There are two types of authentication for key vault which are:

• Access policy, specify and user and what permissions they get, it isnt very granular
• Role based, this is more granular, its a managed identity which is tied to a compute resource, the identity will be given permissions so it can authenticate with key vault
• key vault is used to store secrets for server applications

Azure dedicated hosts

• You can create a dedicated host instance then add them to a host group and you can plit them over different fault domains (racks) this means only your vms go on these hosts not other vms from other customers.
• Each dedicated host can only run a certain SKU of vm and you choose which one.

You have to pay for the use of the entire host even if you only use 10% of it.

• If you buy a dedicated host you can specify maint windows

If however you build an isolated vm type (big spec vm) you will be on your own host because your vm will just consume the entire machine.

Authentication vs Authorization

• authn (authentication) is the process of identifying a person or service, proving they are who they say they are
• authz (authorization) is what that person or service can do once they have been authenticated.

SLA

99.9 - 10 mins downtime a week

99.95 - 5 mins downtime a week

99.99 - 1 min downtime a week

99.999 - 6 seconds downtime a week

Zero Trust

• verify explicitly
• Use least privilege access
• Assume breach

Microsoft Documents

• Microsoft Privacy statement = What personal information MS collects
• Online Services Terms (OST) = What is the key agreement between client and MS
• Data Protection Addendum = More information about the data processing, handling and security of my services

Soverinty

• USA, China and Germany all have sperate Azure cloud for security
• China's Azure for gov is run by 21Vianet

Reservations

• You can get big discounts on vms if you agree to a reserved instance, I.E. I will agree to run this vm for XX years. This means you get a massive discount BUT if you turn the machine off after a year you still have to pay the agreed rates for the rest of the term.

Azure Service Trust Portal

• This has compliance and audit reports for things like sox, iso etc

Azure Trust Center

• Security, privacy, compliance, transparency, trust, GDPR etc standards and how it is auditied. Regulatory documents. It shows all the compliance offerings MS has.

Defence in Depth

CIA = Confidentiality, integrity and availability

Sentinel

This is a SIEM (Security Information Event Management). It is also a SOAR (Security, orchastraction, Automation, Response). Sentinel sits on top of log analytics workspace where all the logs get ingested.

Azure AD Identity Protection

Identity Protection allows organizations to accomplish three key tasks:

• Automate the detection and remediation of identity-based risks.
• Investigate risks using data in the portal.
• Export risk detection data to other tools.

Identity Protection detects risks of many types, including:

• Anonymous IP address use
• Atypical travel
• Malware linked IP address
• Unfamiliar sign-in properties
• Leaked credentials
• Password spray

Support plans

The support plans are as follows:

• Basic - can request 24/7 support for billing only
• Developer - can request support but only get response in working hours
• Standard - can request support 24/7 and have phone support
• Professional direct - can request support 24/7 and have phone support along with architectural support

All the above can do the same with the exception of Standard and Professional Direct which both have 24/7 access to technical support by email and phone after a support request is submitted.

Azure Site Recovery

• Can protect Azure vms and on prem
• You only pay for what you spin up in DR
• You can test DR plans with no impact

Service Trust Portal

• This is where it shows how MS has been audited against things
• Had trust documents
• Has results of MS test's and audits
• This is where you would point your compliance officer for reports

Misc

• Azure resource locks can prevent accidental deletion or modification of an Azure resource. Even an administrator cannot delete it if the lock is in place, the lock will need to be deleted first then the resource deleted. They can be applied to subscriptions, resource groups or resources.
• Microsoft has Azur datacenters in every continent apart from Antarctica
• If a virtual machine has a public IP address, if the vm is stopped/deallocated it will release the public ip address
• Availability set = Services spread over different racks in the same zone
• Availability zone = Services spread over different zones (dc's) in the same region
• Something can only be in 1 resource group
• You cannot put a resource group in another resource group
• AKS = Azure Kubernetes Service is for management, automation and orchestration of containers
• A Azure spot instance is something (vm) you can run at very low cost but it can be shutdown by Microsoft in 30 seconds is resource is needed. So you should not run anything critical on it.
• Azure Cache for Redis, fully managed service which caches frequently used and static data to reduce data and application latency
• Permissions or roles applied to a resource group will get pushed down to everything in it
• A subscription trust 1 and only 1 tenant, a tenant is when on prem AD syncs with Azure AD to create a subscription and the tennant is seperate from this subscription
• ARM = Azure Resource Manager
• VMSS = Virtual Machine Scale Set. You specify in a template how much it can scale up or down then create some conditions, I.E. If the CPU goes over 80% for 5 mins then Azure Batch will queue the job to build and add more vms
• azcopy can be used to copy from local machine to Azure and also from cloud to cloud, it is also server side so does not have to go to you machine then the destination
• ARM templates you can update and change the template and it will go off and make the change, so if you change LRS to GRS it will just make the change
• Bicep is more user friendly than ARM templates
• If you apply a resource lock to a resource group, all the resources get this lock. If there are two or multiple locks applied the most restrictive one will apply. You need to delete the locks before being able to change/delete the resource.
• You can apply tags to resource groups but they do not get pushed down to the resources in the group
• If you delete a resource group, all the resources in the group will be deleted as well
• Tags are not inherited but this can be done via Azure Policy
• Tags can also be enforced using Azure Policy
• Scale Sets can have a max of 1000 vms if you use the Azure vm images but only 600 if you use a custom image
• Azure AD free you can only use the Microsoft authenticator app, premium allows you to do conditional access which allows conditions like only allow logins from Windows 10 and if the user tries to login from an unknown location etc.
• Some things deployed are zone redundant (spanned over multiple zones) some are zonal meaning its deployed to a specific zone
• Azure Hybrid Benefit allows you to bring Windows and SQL licensing if they are covered under a MS assurance plan to Azure to save cost on licensing.
• Buying an Azure subscription directly through the Azure website is referred to as Web Direct
• Azure repos provides a set of version control tools
• AZ Commands will work in powershell