📝

Cheat Sheet

A one page memory refresher. Skim it the morning of the exam, or download the printable one sheet PDF to hand out in the room.

Service types, by what you manage

IaaS: you manage OS and up (most control). Example: Virtual Machine.
PaaS: managed platform, you build apps. Example: App Service, Azure SQL Database.
SaaS: finished software, you manage least. Example: Microsoft 365.

Public shared and open, Private single organization, Hybrid combines both.

CapEx upfront and physical, OpEx ongoing and consumption based, cloud is OpEx.
Estimate: Pricing Calculator. Compare to on-premises: TCO Calculator. Track and budget: Cost Management. Organize cost: Tags.

Management group -> Subscription -> Resource group -> Resource, all through Azure Resource Manager.
Region groups datacenters, Availability zone protects within a region, Region pair protects across regions.

VM full control, App Service web apps, Container Instances one container, AKS many containers, Functions event driven code, Virtual Desktop desktops in the cloud.

VNet and subnet your private network, Peering joins VNets.
VPN Gateway encrypted over the internet, ExpressRoute private dedicated line (not over the internet).

Types: Blob (unstructured), Files (shares), Queue (messages), Table (NoSQL), Disk (VM disks).
Blob tiers: Hot -> Cool -> Cold -> Archive (storage cost drops, access cost rises).
Redundancy: LRS -> ZRS -> GRS -> GZRS (resilience and cost rise). Data box for huge offline moves.

Microsoft Entra ID (was Azure AD) is cloud identity. Authentication = who you are, Authorization = what you can do.
MFA adds a second proof, SSO signs in once for many apps, Conditional Access applies sign in rules by signal.
RBAC grants least privilege by assigning a role at a scope, access inherits down.
Zero Trust never trust always verify, Defense in depth layers protection, Defender for Cloud watches your posture.

Azure Policy enforces rules and reports compliance. Resource locks stop change (ReadOnly) or deletion (CanNotDelete).
Purview governs data, Service Trust Portal holds compliance documents.

Portal, Cloud Shell, CLI, PowerShell to manage, Arc to manage outside Azure, ARM templates and Bicep for infrastructure as code.
Advisor recommends, Service Health shows Azure status, Azure Monitor collects (Log Analytics, Alerts, Application Insights).

Pricing options: pay as you go (no commitment), reservations (1 or 3 year discount), spot (cheap interruptible capacity), Azure Hybrid Benefit (reuse licenses).
A VM needs: a size, an OS disk and optional data disks, a network interface, a VNet and subnet, an optional public IP, and a network security group.
Host an app: VM (full control), containers (portable and scalable), App Service (least to manage).
Endpoints: public endpoint is on the internet, private endpoint gives a service a private IP inside your VNet.
Storage account: general purpose v2 is the standard, Standard is on hard disks, Premium is on solid state disks for low latency.
Sign in: passwordless (Windows Hello, Authenticator, security key) is more secure than a password. Entra Domain Services gives managed domain join and group policy.
Infrastructure as code: ARM templates and Bicep make deployments repeatable, consistent, and version controlled.

3 domains: Cloud concepts (25 to 30%), Architecture and services (35 to 40%), Management and governance (30 to 35%).
Pass mark 700 out of 1000, about 45 minutes, roughly 40 to 60 questions, no hands on labs, no prerequisites.