Microsoft Certified: Azure Solutions Architect Expert flashcards

Azure Virtual Network (VNet) provides private network isolation. A VPN Gateway creates a secure, encrypted connection to a VNet from on-premises networks. Azure Active Directory (Azure AD) provides centralized user authentication for applications.

• VNet isolates resources from public internet
• VPN Gateway enables secure, encrypted on-premises connectivity
• Azure AD provides robust user authentication
• Combined, they ensure private, authenticated, encrypted access

Memory trick: VNet is the House, VPN is the Private Road, AD is the Key.

Managed Identities for Azure Resources provide an automatically managed identity in Azure Active Directory (Azure AD) for applications to authenticate to cloud services without storing credentials in code.

• Eliminates the need for developers to manage credentials.
• Identities are managed by Azure AD.
• Can be assigned to Azure services like Virtual Machines, Azure Functions, App Services.

Memory trick: Managed Identity: The Azure-provided ID card for services.

Network Security Groups (NSGs) control network traffic to Azure resources, while Azure VPN Gateway establishes secure, encrypted connections between on-premises networks and Azure virtual networks.

• NSGs filter traffic based on IP, port, protocol.
• VPN Gateway enables secure private connectivity.
• NSG Flow Logs can be enabled for auditing network traffic.

Memory trick: NSG + VPN: The bouncer and the secret tunnel.

A feature that allows you to create up to four readable secondary databases in different Azure regions for disaster recovery and global distribution.

• Provides continuous asynchronous replication of transactions.
• Supports manual or automatic failover via failover groups.
• Secondaries are readable, enabling offloading read workloads.

Memory trick: Globally Syncing Data Keeps SQL Always Alive.

Combines high availability within a primary region (using Availability Zones) with disaster recovery to a secondary region, offering maximum durability and availability.

• Data is replicated synchronously across three Azure Availability Zones in the primary region.
• Data is then asynchronously replicated to a single physical location in a secondary region.
• Offers 99.99999999999999% (16 nines) annual durability.

Memory trick: Redundancy Levels: L-Z-G-GZ, each step increases protection.

Microsoft Defender for Cloud (formerly Azure Security Center) provides unified security management and advanced threat protection across your hybrid cloud workloads, focusing on security posture management and vulnerability assessments.

• Continuously monitors security posture.
• Provides a secure score based on recommendations.
• Identifies and helps remediate misconfigurations and vulnerabilities.

Memory trick: Defender for Cloud: Your security report card and action plan.

A fully managed enterprise integration message broker that provides reliable and secure asynchronous messaging between applications and services.

• Supports queues and topics for flexible messaging patterns.
• Offers advanced features like guaranteed delivery, duplicate detection, and message sessions.
• Ideal for complex enterprise messaging, transactional processing, and hybrid cloud solutions.

Memory trick: Service Bus: 'Service' with 'Bus'iness-critical messaging.

An enterprise-grade, high-performance, metered file storage service for demanding workloads, built on NetApp ONTAP technology.

• Extremely low latency and high throughput.
• Supports NFSv3, NFSv4.1, and SMB3.1.x protocols.
• Ideal for HPC, SAP, and other performance-sensitive applications.

Memory trick: NetApp Files: 'Net' result is 'App'solutely fast!

A cloud computing service model that provides virtualized computing resources over the internet. It gives users the most control over the operating system, middleware, and applications.

• Highest level of customer control in the cloud
• Managed by customer: OS, runtime, data, applications
• Managed by provider: virtualization, servers, storage, networking
• Suitable for legacy apps, custom OS, strict compliance

Memory trick: IaaS gives 'I' control, PaaS is 'P'latform ready, FaaS is 'F'unction focused, SaaS is 'S'oftware done.

An architectural approach that distributes application components and data across multiple geographic regions to improve availability, resilience, and user experience (low latency) for a globally dispersed user base.

• Uses multiple Azure regions
• Often employs active-active or active-passive patterns
• Leverages global load balancing (e.g., Azure Front Door, Traffic Manager)
• Ensures business continuity and disaster recovery

Memory trick: To go global, be 'active' in 'multi' regions.

A cloud service for securely storing and accessing secrets, keys, and certificates.

• Centralized management of secrets.
• Hardware Security Module (HSM) protected keys.
• Granular access control and audit logging.

Memory trick: Key Vault: The 'Vault' for all your 'Keys' and secrets.

Azure Cosmos DB is a globally distributed, multi-model database service that offers turn-key global distribution, elastic scale of throughput and storage, and guaranteed low-latency with multiple consistency models.

• Globally distributed, multi-region writes
• Guaranteed low latency (reads and writes)
• Tunable consistency models (e.g., eventual consistency)

Memory trick: Cosmos DB reaches across the globe, giving everyone their data super fast, even if it takes a tiny moment to agree.

An Azure service that distributes incoming network traffic across multiple virtual machines or services within a single Azure region. It operates at Layer 4 (transport layer) and supports both TCP and UDP protocols.

• Operates at Layer 4 (transport layer)
• Distributes traffic within a single Azure region
• Supports TCP and UDP protocols
• Provides high availability for applications

Memory trick: Load Balancer handles the 'L'ayer 4 'B'alance.

Azure Virtual WAN is a unified networking solution that provides automated and optimized branch-to-Azure connectivity, inter-branch connectivity, and global transit capabilities. It simplifies complex global network architectures.

• Unified global network connectivity
• Automated branch-to-Azure and inter-branch routing
• Integrated security and centralized management

Memory trick: Virtual WAN is the world's biggest virtual highway, connecting all your branches to the cloud and each other, simply.

A unified analytics platform that brings together enterprise data warehousing, Big Data analytics, and data integration.

• Combines SQL data warehousing, Spark Big Data processing, and data integration pipelines.
• Handles petabytes of data for complex analytical queries.
• Provides real-time insights for business intelligence and machine learning.

Memory trick: Synapse: 'Syn'ergize 'Ap'ply 'Se'e insights.

A collection of virtual machines (compute nodes) that Azure Batch manages to run your compute-intensive tasks. Pools can be configured with various VM types, operating systems, and scaling behaviors.

• Dedicated (guaranteed availability) vs. Spot/Low-Priority (cheaper, can be preempted)
• Auto-scaling for cost optimization
• Support for custom images and startup tasks
• Nodes can be pre-warmed for immediate task execution

Memory trick: Batching needs 'Dedicated' effort, but 'Auto-scale' for savings.

Azure Batch is a managed service for running large-scale parallel and high-performance computing (HPC) applications efficiently in Azure. It automatically provisions and manages compute resources, schedules jobs, and monitors progress.

• Managed service for HPC workloads
• Automatic scaling of compute resources
• Job scheduling and task management

Memory trick: Azure Batch is like a movie director for your big compute jobs, making sure every scene (task) runs perfectly.

A cloud service that provides single-tenant physical hardware security modules (HSMs) for cryptographic key storage and operations.

• FIPS 140-2 Level 3 validated hardware.
• Exclusive customer control over HSMs and keys.
• Ideal for stringent regulatory compliance like PCI DSS, HIPAA.

Memory trick: Dedicated HSM: Your 'Dedicated' 'Key' 'Safe' at the highest 'Level'.

A highly scalable data streaming platform and event ingestion service that can process millions of events per second. It's often used for telemetry, distributed applications, and real-time analytics.

• Massive scale for event ingestion
• Low latency and high throughput
• Supports various streaming protocols
• Integrates with Azure Stream Analytics, Azure Functions, etc.

Memory trick: Events flow like a river into the Hub.

A hybrid Active Directory Domain Services (AD DS) environment extends an on-premises AD DS forest to Azure by deploying additional domain controllers as Azure Virtual Machines. This allows seamless authentication and authorization for legacy applications in Azure while maintaining a single identity plane.

• Extends existing on-premises AD DS forest
• Deploys AD DS domain controllers on Azure VMs
• Seamless for legacy applications requiring traditional domain services

Memory trick: To make your old AD feel at home in the cloud, just build it a new house (VM) right next door.

Customer-Managed Keys (CMK) allow customers to control the encryption keys used for data at rest. Azure Key Vault HSM provides FIPS 140-2 Level 2 validated hardware security modules for key protection.

• CMK provides greater control over encryption keys.
• Azure Key Vault stores and manages CMK.
• HSM-backed keys offer the highest level of key security.
• Supported by various Azure services like Cosmos DB, Storage, SQL.

Memory trick: CMK with HSM gives you the 'key' to security for 'sensitive' data.

A feature of Azure Application Gateway and Azure Front Door that provides centralized protection of web applications from common exploits and vulnerabilities, such as SQL injection, cross-site scripting, and other OWASP Top 10 risks.

• Protects against common web vulnerabilities (OWASP Top 10)
• Operates at Layer 7 (Application Layer)
• Can be deployed with Application Gateway or Front Door
• Provides real-time threat intelligence

Memory trick: For web attacks, 'WAF' is the 'W'all 'A'gainst 'F'aults.

A serverless container service for building and deploying modern apps and microservices at scale. It abstracts away the complexities of Kubernetes, offering features like HTTP-based autoscaling, traffic splitting, and Dapr integration.

• Serverless container execution
• Optimized for microservices
• Built on Kubernetes, but managed by Azure
• Supports HTTP/TCP ingress, Dapr, KEDA, Envoy

Memory trick: For microservices, 'Container Apps' makes it easy.

Platform as a Service (PaaS) in Azure provides a complete development and deployment environment in the cloud, with resources that allow you to deliver everything from simple cloud-based apps to sophisticated, cloud-enabled enterprise applications.

• Reduced administrative overhead (no OS/infrastructure management)
• Increased developer productivity (focus on code)
• Built-in scalability and high availability
• Faster time to market

Memory trick: PaaS makes development a 'breeze' for apps and databases.

A distributed network of servers that delivers web content and streaming media to users based on their geographic location.

• Caches content at edge locations
• Reduces latency and improves load times
• Offloads traffic from origin servers

Memory trick: CDN: 'C'aching 'D'elivers 'N'ear you.

VNet Peering connects two or more Azure Virtual Networks, allowing them to communicate with each other seamlessly. The traffic between peered VNets uses the Azure backbone infrastructure and remains private.

• Connects VNets within or across regions
• High-bandwidth, low-latency private connectivity
• Traffic stays on Azure backbone, no public internet

Memory trick: Peering is like a private bridge between two cloud neighborhoods, super fast and direct.

Web Application Firewall (WAF) in Azure protects web applications from common web-based attacks like SQL injection and cross-site scripting (XSS).

• Operates at Layer 7 (application layer).
• Available with Application Gateway and Front Door.
• Protects against OWASP Top 10 vulnerabilities.
• Provides centralized management and logging.

Memory trick: Application Gateway with WAF is the 'guardian' of your 'web apps' from 'bad traffic'.

A highly scalable and secure data lake solution built on Azure Blob Storage, optimized for big data analytics workloads.

• Hierarchical namespace for folder/file organization
• Exabyte-scale storage, cost-effective
• Optimized for Apache Spark and other big data engines

Memory trick: Data Lake Gen2: Your 'Lake' of data, 'Gen'erally for analytics.

Azure offers various messaging services (queues, topics, events) designed for different asynchronous communication patterns, including reliable message delivery, event-driven architectures, and high-throughput stream ingestion.

• Azure Service Bus: Reliable messaging, queuing, topics, complex patterns
• Azure Event Grid: Event routing for reactive architectures
• Azure Event Hubs: High-throughput stream ingestion
• Azure Storage Queues: Simple, basic message queuing

Memory trick: Service Bus for 'S'ure messages, Event Grid for 'E'very 'G'oal.

Azure Files offers fully managed file shares in the cloud accessible via SMB/NFS. Azure File Sync synchronizes these cloud file shares with on-premises Windows Servers, enabling hybrid cloud scenarios and distributed access.

• Managed SMB/NFS file shares
• Hybrid capabilities with on-premises servers
• Supports high availability and disaster recovery

Memory trick: Files Sync makes old shared folders feel right at home in the cloud, just like before.

A framework for categorizing and strategizing how applications will be moved to the cloud, helping organizations make informed decisions based on complexity, cost, and business value.

• Rehost (Lift and Shift)
• Refactor (Replatform)
• Rearchitect
• Rebuild

Memory trick: To migrate, remember the 'Six R'outes.

A service that enables you to create private connections between Azure data centers and infrastructure that's on-premises or in a colocation environment. ExpressRoute connections do not go over the public internet.

• Private, dedicated connection
• Bypasses the public internet
• Offers higher bandwidth and lower latency than VPNs
• Enhanced security and reliability

Memory trick: ExpressRoute is the 'express' way, not the 'public' way.

A common Azure architecture for ingesting, processing, and storing high volumes of streaming data, typically from IoT or log sources.

• Event Hubs for ingestion
• Stream Analytics for real-time processing
• Data Lake Storage for long-term storage

Memory trick: Events flow like a stream, then get stored in a lake.

A hybrid identity solution where Azure AD Connect synchronizes identities from on-premises AD DS to Azure AD, and Azure AD Domain Services provides managed domain controllers in Azure for legacy applications.

• Extends on-premises AD DS to Azure without deploying DCs.
• Supports Kerberos, NTLM, and LDAP for legacy apps.
• Managed service, reduces administrative overhead.

Memory trick: Connect + AD DS: 'Connect' your old 'AD' to the new 'DS' in the cloud.

Extending an on-premises Active Directory Domain Services (AD DS) to Azure, allowing Azure resources to utilize the existing domain infrastructure.

• Uses Azure AD Connect for identity synchronization
• Azure VMs join the on-premises domain
• Leverages existing Group Policies and user accounts

Memory trick: AD Connect: Bridging your old 'AD' with the 'Cloud'.

Azure offers various compute models: Infrastructure as a Service (IaaS) for maximum control, Platform as a Service (PaaS) for managed platforms, and Function as a Service (FaaS) for event-driven, serverless execution.

• IaaS (VMs): OS control, dedicated hardware options.
• PaaS (App Service): Managed platform, less control.
• FaaS (Functions): Serverless, event-driven, minimal control.

Memory trick: More control means more 'I' in IaaS.

Azure Virtual Networks (VNets) do not natively support multicast or broadcast IP traffic, which is a common challenge when migrating legacy applications.

• Multicast/broadcast not supported in Azure VNets.
• Legacy apps relying on it need adaptation.
• Solutions include explicit IP, DNS, service mesh, or encapsulation.
• Crucial for network design when migrating such apps.

Memory trick: Azure VNets don't 'broadcast' or 'multicast' your old signals.

Azure Route Server facilitates dynamic routing with network virtual appliances and supports multicast routing within an Azure Virtual Network, enabling communication for legacy applications that rely on UDP multicast.

• Enables dynamic routing (BGP) in Azure VNets
• Integrates with NVAs and VPN/ExpressRoute gateways
• Supports multicast routing within the VNet
• Crucial for legacy applications requiring multicast

Memory trick: For multicast, the 'Route Server' directs the 'multi-traffic'.

A high-performance, low-latency file storage service specifically optimized and certified for SAP HANA and NetWeaver deployments on Azure.

• Supports NFSv3 and NFSv4.1 protocols.
• Provides consistent high throughput and low latency.
• Essential for SAP shared file systems like /sapmnt.

Memory trick: For SAP, NetApp Files is the 'key' to 'fast' shared storage.

A cloud service that helps you schedule, automate, and orchestrate tasks, business processes, and workflows when you need to integrate apps, data, systems, and services across enterprises or organizations.

• Serverless workflow orchestration
• Hundreds of connectors for SaaS and Azure services
• Visual designer for building complex workflows

Memory trick: Logic Apps: The 'Logic' to connect your 'Apps'.

The '6 Rs' (Rehost, Refactor, Rearchitect, Rebuild, Replace, Retire) are common strategies for migrating applications to the cloud, each with different levels of effort and cloud optimization.

• Rehost (Lift-and-Shift): Minimal changes, move to IaaS.
• Refactor: Some code changes for PaaS benefits.
• Rearchitect: Significant changes for cloud-native benefits.
• Rebuild/Replace/Retire: More drastic changes or removal.

Memory trick: Minimal changes? Just Rehost and pick compatible services.

A globally distributed, multi-model database service that guarantees low-latency access, high availability, and elastic scalability for applications with evolving semi-structured data.

• Supports schema-agnostic JSON documents.
• Offers multiple consistency models.
• Ideal for high-throughput, low-latency applications requiring global reach and flexible data models.

Memory trick: Cosmos SQL flexes globally for evolving data.

Azure Data Lake Storage Gen2 (ADLS Gen2) builds on Azure Blob Storage and is optimized for big data analytics. Its HDFS compatibility means it can be directly accessed by tools and frameworks that use the Hadoop Distributed File System (HDFS) API, such as Apache Spark, Hadoop, and Hive.

• Petabyte-scale storage for big data
• HDFS-compatible endpoint for analytics engines
• Hierarchical namespace for file system semantics
• Cost-effective with Blob Storage tiers

Memory trick: CDRs in Data Lake Gen2, HDFS powers analytics.

A feature of Azure Blob Storage that allows you to automate the process of tiering blobs to a more cost-effective access tier or expiring them after a specific time period.

• Rules can be based on age, last modified time, or access time.
• Supports moving blobs between Hot, Cool, and Archive tiers.
• Helps optimize storage costs and manage data retention policies.

Memory trick: Blobs manage their life, saving cash on the fly.

A feature of Azure SQL Database that allows you to create readable secondary databases in different Azure regions. It enables disaster recovery and read-scale out globally, with data replicated asynchronously from a primary database.

• Provides disaster recovery capabilities
• Enables read-scale out to secondary regions
• Asynchronous data replication
• Maintains strong consistency at the primary, eventual consistency for replicated reads

Memory trick: Geo-replication copies your data far, ensuring reads are fast and disaster is not.

A graph database service within Azure Cosmos DB that enables you to store and query highly connected data using the Apache TinkerPop Gremlin graph traversal language.

• Optimized for relationships and connections
• Supports popular graph traversal algorithms
• Globally distributed and scalable

Memory trick: Cosmos DB Gremlin: 'G' for 'Graph' and 'G' for 'Gremlin' traversal.

A NoSQL key-value store service that stores large amounts of structured, non-relational data. It's schemaless, allowing for flexible data models, and provides high scalability and low-cost storage.

• Schemaless design for flexible data models
• High scalability for massive datasets
• Low cost for structured non-relational data
• Supports fast lookups by partition key and row key

Memory trick: Table stores simple key-values, Blob stores big files.

Azure SQL Database is a managed relational database service that provides the full capabilities of SQL Server. It is designed for mission-critical applications requiring high availability, scalability, robust security (encryption, auditing), and ACID transaction compliance, making it ideal for enterprise and regulated industries.

• Fully managed relational database
• ACID transaction compliance
• Advanced security (TDE, Always Encrypted, row-level security)
• Comprehensive auditing and compliance features

Memory trick: Azure SQL DB for banking, secure and compliant accounts.

A globally distributed, multi-model database service that allows you to use your existing MongoDB skills and tools with Azure Cosmos DB's enterprise-grade capabilities.

• Compatible with MongoDB wire protocol.
• Supports JSON document model, flexible schema.
• Offers global distribution, elastic scale, and guaranteed low latency.

Memory trick: Mongo profiles scale globally, social and free.

A low-cost storage tier within Azure Blob Storage optimized for rarely accessed data with flexible latency requirements (hours for retrieval). It is suitable for long-term backups, archival, and compliance data.

• Lowest cost storage tier for blobs
• High latency for data retrieval (hours)
• Ideal for long-term retention and archival
• Supports large object storage

Memory trick: Hot, Cool, Archive: How fast do you need that data back?

Fully managed file shares in the cloud that are accessible via the industry-standard Server Message Block (SMB) protocol, Network File System (NFS) protocol, and Azure Files REST API.

• Supports SMB 3.0 and NFS 4.1
• Can be mounted concurrently by cloud or on-premises deployments
• Offers Standard (HDD) and Premium (SSD) tiers

Memory trick: Azure Files: 'F' for 'Files' for all your shared 'F'iles.

A service tier for Azure SQL Database that offers highly scalable storage (up to 100 TB) and compute, designed for large relational workloads with high transactional throughput and low latency, while maintaining ACID properties.

• Scales up to 100 TB of data
• Decouples compute and storage for independent scaling
• Optimized for high transactional throughput and low latency
• Maintains full ACID compliance

Memory trick: Hyperscale handles huge data, ACID-fast, and scales like a rocket.

Azure Stream Analytics is a fully managed, real-time analytics service that is designed to analyze and process large volumes of streaming data from multiple sources. It allows for complex event processing (CEP), aggregations, and pattern matching in real time, with SQL-like query language.

• Real-time stream processing engine
• SQL-like query language for data transformation and analysis
• Integrates with Event Hubs, IoT Hubs, and Blob Storage as inputs
• Outputs to various services like Power BI, Cosmos DB, SQL DB

Memory trick: Track packages with Stream Analytics, instant insights flow.

A fast, fully managed data analytics service for real-time analysis on large volumes of data streaming from applications, websites, IoT devices, and more.

• Optimized for time-series and log data
• Uses Kusto Query Language (KQL)
• Supports high-throughput data ingestion

Memory trick: Kusto: 'K' for 'Key' to IoT insights, 'U' for 'Unleash' real-time data.

A Self-hosted Integration Runtime (SHIR) is a compute infrastructure used by Azure Data Factory to provide data integration capabilities across different network environments. It is installed on an on-premises machine or a VM within a private network and enables secure, managed data transfer between on-premises data stores and Azure services.

• Connects Azure Data Factory to on-premises data sources
• Acts as a secure gateway for data movement
• Executes Data Factory activities on-premises
• Essential for hybrid data integration scenarios

Memory trick: SHIR in each store, Data Factory collects all.

A cloud-based enterprise data warehouse that leverages a massively parallel processing (MPP) architecture to run complex queries across petabytes of data, offering elastic scalability and integration with other analytics services.

• Separates compute from storage for independent scaling
• Optimized for analytical workloads (OLAP)
• Integrates with Power BI and other analytics tools

Memory trick: Synapse Analytics: 'S' for 'Scale' your 'S'tructured data for 'S'uper analytics.

A fully managed analytics, storage, and visualization service for industrial IoT. It's optimized for collecting, processing, storing, and querying large volumes of time-series data generated by IoT devices and sensors.

• Purpose-built for time-series data
• Efficient storage and long-term retention
• Fast aggregate queries over time ranges
• Integrates with IoT Hub and Event Hubs

Memory trick: Time Series Insights finds trends in your time-stamped data, like a historian.

Azure Blob Storage is Microsoft's object storage solution for the cloud. It is optimized for storing massive amounts of unstructured data, such as text or binary data. It offers high scalability, durability, and availability, and supports different access tiers (Hot, Cool, Archive) for cost optimization.

• Stores unstructured data (blobs)
• Highly scalable and durable
• Supports HTTP/HTTPS access from anywhere in the world
• Offers different access tiers for cost optimization based on access frequency

Memory trick: Stream videos globally with Blob, tiering costs just right.

ADLS Gen2 provides a hierarchical namespace that allows it to present object storage as a file system, making it fully compatible with Hadoop Distributed File System (HDFS) semantics and tools like Apache Spark and Hadoop.

• Leverages Azure Blob Storage's scale and cost
• Enables POSIX-compliant file system operations
• Optimized for analytical workloads

Memory trick: ADLS Gen2: HDFS's best 'Gen'etic match in the cloud.

A feature in Azure Blob Storage that enables you to store business-critical data in a WORM (write once, read many) state for a time-based retention interval or an indefinite legal hold.

• Ensures data is tamper-proof
• Supports time-based retention or legal hold
• Critical for regulatory compliance (e.g., FINRA, SEC, HIPAA)

Memory trick: Blob Immutability: WORM for seven years, like a digital vault.