Your FREE AZ-900 Flashcards 2026 – 300+ Cards

The delivery of computing services — servers, storage, databases, networking, software, and analytics — over the internet, billed on a pay-as-you-go basis

A division of security duties between the cloud provider and the customer; what each owns shifts with the service type (IaaS, PaaS, SaaS)

Information and data, devices, and accounts and identities — regardless of the cloud service type used

Physical hosts, physical network, and the physical datacenter — regardless of service type

A cloud model that provides virtualized compute, storage, and networking; the customer manages the OS, runtime, and applications. Example: Azure Virtual Machines

A managed platform for building and deploying apps; the provider manages OS and infrastructure, the customer manages apps and data. Example: Azure App Service

Fully managed software delivered over the internet; the provider manages almost everything and the customer just uses the app. Example: Microsoft 365

IaaS — the customer manages the operating system, applications, and data on top of the provider's infrastructure

SaaS — the provider manages almost the entire stack; the customer mainly manages data, identities, and access

Cloud services owned and operated by a third-party provider (like Microsoft) and shared across many customers over the public internet; no capital expense

Cloud resources used exclusively by one organization, hosted on-premises or by a third party; offers more control but requires more management and cost

A computing environment that combines public and private clouds, allowing data and apps to move between them for flexibility, compliance, and gradual migration

Managing and governing servers, Kubernetes clusters, and databases across on-premises, multicloud, and edge from a single Azure control plane (key to hybrid scenarios)

Upfront spending on physical assets like servers and datacenters, depreciated over time; typical of on-premises infrastructure

Spending on services as you consume them with no large upfront cost; the cloud's pay-as-you-go model is OpEx

OpEx — you pay for resources as you consume them, converting large upfront capital costs into ongoing operational costs

You pay only for the resources you use, with no upfront cost and the ability to stop paying when you stop using a resource

Designing services to remain accessible and operational for as much time as possible, minimizing downtime — often by spreading across availability zones

The ability to add or remove resources to match demand; includes scaling up (bigger resources) and scaling out (more instances)

Scaling up (vertical) adds power to an existing resource; scaling out (horizontal) adds more instances of a resource

The ability to automatically add or remove resources as demand changes in near real time, so you pay only for what you need at any moment

The ability of a system to recover from failures and continue to function; the cloud supports it with redundant, decentralized regions worldwide

Being able to forecast performance and cost; achieved through autoscaling, load balancing, and tools like the Pricing Calculator and Cost Management

The ability to deploy and configure cloud resources quickly as requirements change, rather than waiting weeks to procure hardware

The ability to restore services and data after a major outage, often using geo-redundant storage and services across paired regions

Centralized policy, templates, and built-in tools (like Azure Policy and Microsoft Defender for Cloud) help meet compliance and update standards consistently

Management OF the cloud (autoscaling, monitoring, alerts) and management IN the cloud (web portal, CLI, APIs, templates) to control resources

A system's ability to keep operating without interruption when one or more components fail, often through redundancy

Resources can be provisioned in minutes instead of weeks, so teams can build, test, and deploy applications faster

Large providers buy compute and storage at huge volume and pass the lower per-unit cost to customers, making cloud cheaper than self-hosting

SaaS — the provider manages everything except the customer's data, identities, and access

PaaS — the platform handles infrastructure and OS while the developer focuses on the application

IaaS — you run virtual machines and control the OS, much like on-premises servers

Microsoft is responsible for the security OF the cloud (physical infrastructure); the customer is responsible for security IN the cloud (data, identities, configuration)

OpEx / consumption-based — you scale resources to actual demand instead of buying for peak capacity upfront

If one datacenter or zone fails, the application keeps running from another zone, minimizing downtime

Hybrid cloud — keep regulated data on a private cloud or on-premises and use public cloud elsewhere

Using cloud services from more than one provider (for example Azure and another vendor) to avoid lock-in or use best-of-breed services

Providers offer built-in security, continuous monitoring, automatic updates, and certifications most single organizations cannot match alone

More control and isolation, but higher cost and management overhead, and you lose the elasticity and pay-as-you-go benefits of public cloud

Workloads that benefit from elasticity and low cost without capital investment, such as web apps with variable traffic

Keeping sensitive or regulated data on-premises while bursting other workloads to public cloud, or migrating gradually

No upfront capital cost and no charge for idle capacity — you pay only for what you actually use

Elasticity — it automatically adds or removes resources in near real time as demand changes

High availability, typically achieved by spreading the workload across availability zones

Reliability — supported by redundant, decentralized regions and disaster-recovery options

Performance and cost can be forecast and controlled using autoscaling, load balancing, and tools like the Pricing Calculator

Management OF the cloud is automation, monitoring, and self-healing; management IN the cloud is the tools (portal, CLI, APIs, templates) you use to control resources

SaaS — finished software you consume without managing the platform or infrastructure

The customer — IaaS leaves the guest operating system to you

Microsoft — the provider manages the operating system and platform in PaaS

An application or service (and its resources) running in the cloud, such as a website, database, or batch job

You can deploy resources to regions worldwide quickly to reduce latency and meet local requirements, without building datacenters

More control and flexibility (you manage the OS) but more responsibility for patching, scaling, and maintenance

They can provision and reconfigure resources in minutes instead of waiting weeks to buy and install hardware

A set of datacenters deployed within a latency-defined perimeter and connected by a dedicated low-latency network; you choose a region to deploy resources

A physically separate datacenter (or group) within an Azure region, each with independent power, cooling, and networking, used for high availability

Two regions in the same geography paired for disaster recovery; updates roll out one region at a time and data can be replicated between them

A physical facility containing servers and infrastructure; multiple datacenters make up an availability zone or region

At least three physically separated availability zones

An isolated instance of Azure for specific compliance or legal needs, such as Azure Government (US) or Azure operated by 21Vianet (China)

A manageable item available through Azure, such as a virtual machine, storage account, database, or virtual network

A logical container that holds related Azure resources; resources can belong to only one resource group at a time and share its lifecycle

No. A resource exists in exactly one resource group, though it can be moved to another

A logical unit of Azure services linked to an account; it sets billing boundaries and access control and contains resource groups

A container above subscriptions used to apply governance (policies, access) across many subscriptions at once in a hierarchy

Management groups, then subscriptions, then resource groups, then resources

An on-demand, scalable IaaS compute resource that runs a full operating system, giving you control like a physical server

A service that lets you create and manage a group of identical, load-balanced VMs that automatically scale out or in with demand

A way to group VMs across fault domains and update domains within a datacenter to protect against hardware failures and maintenance

A desktop and app virtualization service that runs Windows desktops in the cloud, accessible from anywhere on any device

The fastest, simplest way to run a single container in Azure without managing virtual machines (serverless containers)

A managed Kubernetes service for deploying, scaling, and managing containerized applications at scale

A PaaS offering for hosting web apps, REST APIs, and mobile back ends without managing the underlying infrastructure

A serverless compute service that runs event-triggered code without provisioning servers; you pay only while the code runs

A model where the cloud provider fully manages the infrastructure and you pay only for execution; Azure Functions is the main example

When you want lightweight, portable, fast-starting workloads that share an OS kernel and don't need a full guest operating system per instance

The fundamental building block for private networks in Azure, enabling resources to securely communicate with each other, the internet, and on-premises networks

Connecting two virtual networks so resources can communicate directly using private IP addresses, as if on the same network

A service that sends encrypted traffic between an Azure virtual network and an on-premises location (site-to-site) or device (point-to-site) over the internet

A service that creates a private, dedicated connection between on-premises infrastructure and Azure, bypassing the public internet for more reliability and speed

VPN Gateway uses encrypted traffic over the public internet; ExpressRoute uses a private, dedicated connection that never touches the public internet

A hosting service for DNS domains that resolves domain names to IP addresses using Microsoft's global network

A set of inbound and outbound security rules that allow or deny network traffic to Azure resources within a virtual network

A container that holds Azure Storage data objects — blobs, files, queues, and tables — with a unique namespace accessible worldwide

Object storage optimized for storing massive amounts of unstructured data such as text, images, video, and backups

Hot (frequent access), Cool (infrequent, stored 30+ days), Cold (rarely accessed, 90+ days), and Archive (lowest cost, offline, rarely accessed)

The Archive tier — but it has the highest retrieval cost and latency and requires rehydration before reading

Fully managed file shares in the cloud accessible via SMB or NFS, which can be mounted by cloud or on-premises machines

Block-level storage volumes (managed disks) attached to Azure Virtual Machines, similar to a physical disk in a server

A service for storing large numbers of messages that can be accessed from anywhere, used to decouple and scale application components

A NoSQL key-value store for structured, non-relational data, ideal for large amounts of flexible datasets

Replication that keeps three copies of your data within a single datacenter; the lowest-cost, lowest-durability redundancy option

Replication that copies data synchronously across three availability zones in a single region for higher availability

Replication that copies data to a secondary region hundreds of miles away, protecting against a complete regional outage

Geo-redundant storage (GRS) or geo-zone-redundant storage (GZRS), which replicate to a secondary region

Moving large amounts of data into Azure; AzCopy and Azure Storage Explorer also help upload and manage storage data

Microsoft's cloud-based identity and access management service that authenticates users and controls access to apps and resources

Authentication (AuthN) proves who you are; authorization (AuthZ) determines what you are allowed to do once authenticated

A capability that lets a user sign in once and access multiple applications without re-entering credentials, reducing password fatigue

Requiring two or more verification factors — something you know, have, or are — to sign in, greatly improving account security

A Microsoft Entra feature that applies access policies based on signals like user, location, device, and risk before granting access

A tool that detects, investigates, and remediates identity-based risks using automated risk policies

A capability that lets external partners and guests securely access your resources using their own identities

A web-based, unified console where you build, manage, and monitor everything from simple web apps to complex deployments using a graphical interface

A browser-based, authenticated shell experience for managing Azure resources, available in Bash or PowerShell

A set of cmdlets for managing Azure resources directly from the PowerShell command line or in automation scripts

A cross-platform command-line tool for creating and managing Azure resources using commands and scripts

An app for iOS and Android that lets you monitor resources, check health and metrics, and run Cloud Shell commands on the go

A service that extends Azure management and governance to resources running on-premises, at the edge, and in other clouds

The deployment and management layer for Azure; every request to manage a resource goes through ARM for consistent control, access, and tagging

JSON files that define infrastructure as code, so you can deploy Azure resources declaratively and repeatedly

A domain-specific language that simplifies infrastructure as code on Azure with cleaner syntax than ARM JSON templates

A fully managed PaaS relational database engine based on SQL Server, with automated patching, backups, and high availability

A globally distributed, multi-model NoSQL database service with low latency and elastic scalability across many regions

Fully managed, open-source relational database services on Azure that handle patching, backups, and scaling

A PaaS option that gives near-100% compatibility with on-premises SQL Server, ideal for lift-and-shift database migrations

An online store of certified, ready-to-use applications and services from Microsoft and partners that can be deployed into Azure

Full control of the OS and software, lift-and-shift migrations, custom configurations, and apps that need a complete server

Azure Functions (serverless) — it runs only when triggered and you pay only for execution time

Azure ExpressRoute — a dedicated private connection that bypasses the public internet

Azure Blob Storage — object storage designed for massive amounts of unstructured data

Azure Kubernetes Service (AKS)

Microsoft Entra ID — the same service, rebranded

Entra ID is a cloud identity service using internet protocols (no Group Policy or OUs); on-premises AD manages domain-joined Windows devices with Group Policy

Distributes incoming network traffic across multiple resources to improve availability and reliability

A distributed network of servers that caches content close to users to deliver web content with low latency

Azure Files provides mountable SMB/NFS file shares with a folder structure; Blob Storage is flat object storage for unstructured data

A group of hardware sharing a common power source and network switch; spreading VMs across fault domains protects against hardware failure

A logical group of hardware updated and rebooted together during maintenance; spreading VMs across them avoids simultaneous reboots

Azure Cosmos DB

A central hub of tools to assess and migrate on-premises servers, databases, web apps, and data to Azure

Service availability, data residency/compliance, latency to users, and pricing — all can vary by region

A fully managed enterprise message broker used to decouple applications and services with queues and publish-subscribe topics

Azure Virtual Machines (IaaS) — you fully manage the guest operating system

Name-value pairs applied to resources to organize them and group costs for billing, governance, and reporting

Virtual Machine Scale Sets

Locally redundant storage (LRS)

Each subscription has its own billing and usage tracking; organizations often split workloads, environments, or departments into separate subscriptions

Hosting web applications and APIs without managing servers, with built-in scaling, deployment slots, and SSL

IPsec/IKE encrypted tunnels over the public internet between an on-premises VPN device and an Azure VPN gateway

A resource (such as a single VM or storage account)

The Azure portal

Azure CLI, Azure PowerShell, and Azure Cloud Shell (browser-based)

Azure Content Delivery Network (CDN)

Structured, non-relational (NoSQL) key-value data that does not need complex joins or stored procedures

Deploying across zones protects against an entire datacenter failure within a region, offering up to a 99.99% SLA

Virtual network (VNet) peering

Allows resources in the virtual network to communicate with the public internet, while NSGs and subnets control the traffic

Azure SQL Database (or SQL Managed Instance for higher compatibility)

Automatic data replication options, sequential updates to avoid simultaneous downtime, and prioritized recovery during a broad outage

The number of times users must enter credentials and the number of passwords they must remember, lowering risk and help-desk load

Conditional Access

Azure Container Instances (ACI)

Azure Disk Storage (managed disks)

A service that supplies Azure resources (such as Microsoft.Compute for VMs); ARM uses providers to create and manage resources

A networking service that brings many networking, security, and routing functions together to connect branches and VNets at scale

An endpoint that exposes a service over the public internet, reachable by a public IP address

A network interface that connects you privately to an Azure service using a private IP inside your VNet, keeping traffic off the public internet

A service that provides secure RDP and SSH access to VMs directly in the portal without exposing public IP addresses

A range of IP addresses that segments a virtual network so you can group and secure resources separately

A web traffic load balancer that manages traffic to web applications, with features like SSL termination and a web application firewall

A service that distributes inbound network traffic across backend resources to improve availability and scale

Azure Files offers shared file shares many machines can mount over SMB/NFS; Disk Storage is a block disk attached to a single VM

A high-performance, fully managed file storage service for enterprise workloads requiring low latency

A physical device used to transfer very large amounts of data into Azure when network transfer is impractical

A command-line tool for copying data to and from Azure Storage (blobs and files) efficiently

A standalone app that provides a graphical interface to manage Azure Storage data across accounts

A service that synchronizes on-premises file servers with Azure Files, keeping a cloud copy and freeing local space

Storage (a disk), networking (a NIC and virtual network), and an OS image are all required to run a VM

Delivering secure, cloud-hosted Windows desktops and apps to users on any device, ideal for remote or contract workers

When you want managed hosting with built-in scaling and deployment and don't need control of the underlying OS

Entra ID is cloud identity using modern protocols; Entra Domain Services provides managed domain features (like LDAP and domain join) without running domain controllers

Signing in without a password using methods like Windows Hello, the Microsoft Authenticator app, or FIDO2 security keys

B2B lets partner guests use their own credentials to access your resources; B2C lets customers sign in to your apps with their identities

Azure Kubernetes Service (AKS)

Azure Container Instances (ACI)

Globally distributed, low-latency NoSQL applications needing elastic scale across many regions

A fully managed PaaS relational database based on the SQL Server engine, with automated patching, backups, and scaling

Geo-zone-redundant storage (GZRS) — zone redundancy in the primary region plus a copy in the paired region

The Azure region — service availability, data residency, and pricing all vary by region

Hosting and resolution of DNS domains using Microsoft's global network of name servers

Virtual network (VNet) peering

A block storage volume managed by Azure and attached to a VM, where Azure handles storage account management behind the scenes

The cool or cold tier; the archive tier is cheaper still but is offline and must be rehydrated

A resource — a single service instance like a VM or storage account

Policies and access at the management group are inherited down to subscriptions, then resource groups, then the resource

To separate billing and apply different governance and limits to different environments or departments

Azure Bastion

Azure ExpressRoute

A network interface card that connects a VM to a virtual network so it can communicate

Azure SQL Managed Instance

They are lightweight, fast to start, and portable because they share the host OS kernel instead of bundling a full OS

Azure App Service

Single sign-on (SSO)

Conditional Access

A suite of tools to monitor, allocate, and optimize Azure spending through analysis, budgets, alerts, and recommendations

A free tool to estimate the cost of Azure products and services before you deploy them, by configuring a sample architecture

A tool that estimates the cost savings of migrating on-premises workloads to Azure by comparing current and cloud costs

The Pricing Calculator estimates the cost of a planned Azure deployment; the TCO Calculator compares on-premises costs against Azure to show savings

Resource type, services used, region, ingress/egress traffic, subscription type, and the Azure Marketplace items chosen

Azure generally does not charge for data going into Azure (ingress) but charges for data leaving regions or Azure (egress)

A spending threshold set in Cost Management that triggers alerts when actual or forecasted costs approach or exceed it

An automated notification from Cost Management when spending, a budget, or a credit reaches a defined threshold

Tags group and report costs by department, project, or environment, making it easy to allocate and analyze spending

A way to commit to one or three years of a resource for a significant discount versus pay-as-you-go pricing

A licensing benefit that lets you use existing on-premises Windows Server and SQL Server licenses to lower Azure costs

Running interruptible workloads on unused capacity at deep discounts, with the trade-off that Azure can reclaim them anytime

Use reservations or savings plans, right-size and deduplicate resources, use spot VMs, apply Azure Hybrid Benefit, and shut down unused resources

A formal commitment by Microsoft about the expected performance and uptime of a service, expressed as a percentage

Roughly up to about 8.7 hours of allowable downtime per year (around 43 minutes per month)

No. Free tier and preview services typically have no financially backed SLA

Add redundancy (availability zones, multiple regions) and remove single points of failure; combining services multiplies their individual SLAs

A credit applied to your bill when Microsoft fails to meet the committed SLA for a paid service

Services move through private preview, public preview, then general availability (GA); preview features may lack full SLA and support

A governance service that creates, assigns, and manages rules to enforce standards and assess compliance across resources

Azure Policy controls WHAT properties resources can have (compliance/standards); RBAC controls WHO can do WHAT actions (access)

A lock that prevents accidental deletion or modification of a resource; types are CanNotDelete (Delete) and ReadOnly

CanNotDelete allows reading and modifying but not deleting; ReadOnly allows only reading — no modifying or deleting

A way to define a repeatable set of resources, policies, and assignments to deploy compliant environments; Microsoft now recommends Template Specs and deployment stacks instead

A unified data governance service that helps discover, catalog, classify, and manage data across on-premises, multicloud, and SaaS

A system that grants users, groups, and apps only the access they need by assigning roles at a defined scope

Management group, subscription, resource group, or individual resource — and it is inherited downward

Granting users only the minimum access required to do their job, reducing the attack surface

A model that assumes breach and verifies every request explicitly, uses least-privilege access, and never trusts based on network location alone

A layered security strategy where multiple defenses (physical, identity, perimeter, network, compute, app, data) slow and stop attackers

A tool for cloud security posture management and workload protection that monitors security, gives a secure score, and detects threats across hybrid and multicloud

A measurement of your security posture; higher scores mean fewer identified risks and better adherence to recommendations

A platform service that collects, analyzes, and acts on telemetry (metrics and logs) from Azure and on-premises environments

A tool within Azure Monitor for writing and running queries against collected log data to investigate and analyze it

An Azure Monitor feature for application performance management (APM) that monitors live web apps for performance and usage

Notifications and automated actions triggered when a metric or log condition crosses a defined threshold

A service that gives personalized alerts and guidance about Azure service issues, planned maintenance, and health advisories affecting your resources

Azure status (global outages), Service health (issues affecting your services), and Resource health (health of your specific resources)

A global page showing the health of Azure services across all regions, regardless of which resources you use

A view that reports the current and past availability of your individual resources and explains why a resource may be unavailable

Checking resource status, metrics, alerts, and service health, and running quick management tasks from a phone

A service that provides just-in-time, time-bound privileged access with approval workflows and auditing to limit standing admin rights

Azure Policy — it can deny or audit resources that do not meet the rule

A resource lock (CanNotDelete / Delete lock)

The Total Cost of Ownership (TCO) Calculator

The Azure Pricing Calculator

Microsoft Defender for Cloud

Azure Monitor

Azure Service Health

WHO can perform actions on resources (access), whereas Azure Policy controls WHAT configuration resources may have

Microsoft Purview

It proactively warns you before spending exceeds plan, helping avoid surprise bills

Costs (power, real estate, taxes) and supply differ by location, so Azure pricing varies by region

Composite SLA is the product of each service's SLA, so adding more dependent services usually lowers the overall guarantee unless you add redundancy

Any modification or deletion of the resource; only read operations are allowed

It lets you reuse existing eligible Windows Server and SQL Server licenses instead of paying for new ones in Azure

Tracking and improving your security posture by following Defender for Cloud's prioritized recommendations

Log Analytics

Application Insights

Assigning a policy at a management group applies it to all subscriptions and resources beneath it, enabling org-wide governance

A flexible pricing model giving lower rates in exchange for a one- or three-year commitment to a fixed hourly spend on compute

Reservations commit to a specific resource type/region for a discount; savings plans commit to an hourly compute spend and apply flexibly across services

A free service that analyzes your configuration and gives personalized recommendations for cost, security, reliability, performance, and operational excellence

Cost, security, reliability, operational excellence, and performance

About 52 minutes of downtime per year

A budget is the spending threshold you set; a cost alert is the notification fired when spending nears or crosses that budget

Azure Advisor

Granting elevated permissions only for the time they are needed and removing them afterward, reducing standing privilege (provided by Entra PIM)

To separate billing, apply different policies and limits, and isolate environments (such as production and development)

You only need an overall scaled score of 700 to pass; you do not have to pass each individual skill area

Monitoring, allocating, budgeting, and optimizing Azure spending across subscriptions

The Azure Pricing Calculator

The Total Cost of Ownership (TCO) Calculator

Data egress (outbound transfer) is charged, while inbound (ingress) is usually free

They label resources so spend can be grouped and reported by department, project, or environment

A one- or three-year commitment to a resource for a significant discount over pay-as-you-go

Whenever you want to be alerted before spending crosses a planned threshold to avoid surprise bills

Azure Policy

Azure role-based access control (RBAC)

A resource lock (CanNotDelete / Delete lock)

Only reading the resource — no modifications and no deletion

Management group, subscription, resource group, or resource — and they are inherited downward

Grant each identity only the minimum access required to do its job, reducing risk

Discovering, cataloging, classifying, and managing data across on-premises, multicloud, and SaaS sources

Personalized best practices across cost, security, reliability, performance, and operational excellence

Whether Azure outages, planned maintenance, or health advisories are affecting your specific resources

Metrics and logs (telemetry) from Azure and on-premises resources for analysis, alerting, and visualization

Log Analytics

Application Insights

Service Health reports Azure platform issues affecting you; Monitor reports your own resources' and apps' performance telemetry

A web-based graphical console for creating, managing, and monitoring Azure resources

A browser-based, authenticated command-line environment (Bash or PowerShell) for managing Azure

Defining and deploying infrastructure through declarative files (like ARM templates or Bicep) for repeatable, consistent results

The deployment and management layer all Azure management requests pass through for consistent control and access

A JSON file that defines Azure resources declaratively so the same environment can be deployed repeatedly

A domain-specific language that simplifies infrastructure as code with cleaner syntax than ARM JSON

Extending Azure management, policy, and RBAC to servers and clusters running on-premises, at the edge, or in other clouds

About 8.7 hours per year (roughly 43 minutes per month)

Add redundancy across availability zones or regions and remove single points of failure

No — free tier and preview services typically have no financially backed SLA

A licensing benefit that lets you reuse existing Windows Server and SQL Server licenses to lower Azure cost

A measurement of your security posture; following its recommendations raises the score and reduces risk

Opening management ports to a VM only when needed and for a limited time, reducing the attack surface

Azure Policy answers 'what configuration may resources have?'; RBAC answers 'who may perform which actions?'