Quick Reference Cheat Sheet

This cheat sheet provides a consolidated, high-yield summary of the most critical concepts for the AZ-900 exam. Use it for last-minute revision to reinforce the key facts and differentiators.

Cloud Fundamentals

• CapEx (Capital Expenditure): Upfront spending on physical infrastructure. The on-premises model.
• OpEx (Operational Expenditure): Spending on services as you use them. The cloud model.
• IaaS (Infrastructure as a Service): You manage the OS, apps, and data. Azure manages the hardware. Example: Azure VMs.
• PaaS (Platform as a Service): You manage the app and data. Azure manages the OS and hardware. Example: Azure App Service.
• SaaS (Software as a Service): You just use the software. Azure manages everything. Example: Microsoft 365.
• Public Cloud: Services offered over the public internet. Lowest cost, no maintenance.
• Private Cloud: Infrastructure dedicated to a single organization. Maximum control.
• Hybrid Cloud: Combines public and private clouds, allowing data and apps to be shared between them.

Azure Architecture

• Region: A geographic area with one or more data centers. You always deploy resources into a region.
• Availability Zone (AZ): A physically separate data center within a region. Protects against data center failure. Not all regions have AZs.
• Region Pair: Two regions in the same geography, paired for disaster recovery. Used by GRS storage.
• Resource Group: A logical container for resources. Every resource must be in one. Deleting a resource group deletes all resources within it.
• Resource Groups CANNOT be nested.
• A resource can only be in ONE resource group.
• Subscription: A billing and management boundary. Can contain multiple resource groups.

Compute & Networking

• Azure VM: IaaS service. You have full control of the OS.
• Availability Set: Protects against hardware failure within a data center. Provides a 99.95% SLA. Spreads VMs across Fault Domains and Update Domains.
• Virtual Machine Scale Sets (VMSS): Used for autoscaling identical VMs.
• Azure App Service: PaaS for hosting web apps and APIs.
• Azure Functions: Serverless, event-driven compute. Pay per execution.
• VNet (Virtual Network): Your private, isolated network in Azure.
• NSG (Network Security Group): Firewall rules to filter traffic to/from a subnet or NIC. Stateful.
• VNet Peering: Connects two VNets privately over the Microsoft backbone.
• VPN Gateway: Connects on-premises network to an Azure VNet over the public internet (encrypted).
• ExpressRoute: A private, dedicated connection from on-premises to Azure. Bypasses the internet.

Storage

• Blob Storage: Object storage for unstructured data (files, images). Pay for what you store.
• File Storage: Managed file shares using SMB or NFS protocol.
• Disk Storage: Persistent disks for Azure VMs.
• Storage Tiers (Blob):
  • Hot: For frequently accessed data. Highest storage cost, lowest access cost.
  • Cool: For infrequently accessed data (min 30 days). Lower storage cost, higher access cost.
  • Archive: For long-term archival (min 180 days). Lowest storage cost, highest access cost, retrieval takes hours.
• Storage Redundancy:
  • LRS: 3 copies in one data center.
  • ZRS: 3 copies across 3 AZs in one region.
  • GRS: 6 copies total; 3 in primary region, 3 in paired region.

Identity & Security

• Microsoft Entra ID: Azure's cloud-based identity and access management service.
• Authentication (AuthN): Proving who you are.
• Authorization (AuthZ): Defining what you can do. Managed by RBAC in Azure.
• MFA (Multi-Factor Authentication): Something you know, have, and/or are. Dramatically increases security.
• Conditional Access: IF-THEN policies for authentication (e.g., IF user is risky, THEN require MFA).
• RBAC (Role-Based Access Control): Granting permissions (Owner, Contributor, Reader) at a scope (Subscription, RG, Resource).
• Resource Locks: Protects resources from accidental deletion (CanNotDelete) or modification (ReadOnly). Overrides RBAC permissions.
• Azure Policy: Enforces rules and compliance at scale. Can Deny non-compliant resource creation.
• Defender for Cloud: Provides Security Score and threat protection for Azure and hybrid workloads.
• Azure Key Vault: Securely stores secrets, keys, and certificates.

Cost & Management

• Pricing Calculator: Use to estimate future costs.
• TCO Calculator: Use to compare on-premises costs to Azure costs.
• Cost Management + Billing: Use to analyze current and past spending.
• Tags: Key-value pairs for organizing resources and tracking costs. Tags are NOT inherited.
• Azure Advisor: Free service that provides personalized recommendations for Cost, Security, Reliability, Performance, and Operational Excellence.
• SLA (Service Level Agreement): Microsoft's uptime guarantee. A composite SLA of multiple services is calculated by multiplying the individual SLAs (e.g., 99.9% * 99.5%).
• Service Health: Personalized alerts for Azure platform incidents, planned maintenance, and health advisories.