Microsoft Azure Fundamentals (AZ-900) · glossary

Azure Fundamentals glossary

#ABCDEFGHIKLMNOPRSTUVWZAcronyms

#

21Vianet

Company that operates Microsoft Azure in China under a partnership; Microsoft doesn't directly run those datacenters. Lesson: Sovereign regions

A

Access control boundary

Subscription role in which access policies are applied and managed at the subscription level. Lesson: Subscriptions

Access tiers

Blob storage levels (hot, cool, cold, archive) that trade storage price against access price. Lesson: Four access tiers

Action group

A reusable set of notifications and actions, such as email, text or a webhook, triggered by alerts. Lesson: Azure Monitor alerts

Active Directory Domain Services (AD DS)

The traditional Windows Server directory that runs on domain controllers in an organization's own network. Lesson: Hybrid identity

active/active

VPN Gateway setup where both instances carry traffic at once, for higher resilience. Lesson: VPN Gateway details

active/standby

Default VPN Gateway setup: one instance carries traffic while a second waits to take over. Lesson: VPN Gateway details

Activity log

Azure log of subscription-level events, such as who created, changed or deleted a resource. Lesson: Azure Monitor alerts

Alias records

Azure DNS records that point at an Azure resource and update automatically when its IP address changes. Lesson: Azure DNS

Anycast

Network routing where the closest of many servers sharing one address answers; Azure DNS uses it. Lesson: Azure DNS

API apps

App Service hosting for web APIs built on REST, with Swagger support. Lesson: Azure App Service

Append blobs

Blobs optimized for adding data to the end, such as log files. Lesson: Blobs up close

Application Insights

Azure Monitor feature for application performance monitoring: requests, response times, failures and dependencies. Lesson: Application Insights

Application programming interfaces (APIs)

Defined ways for programs to talk to a service; every Azure action is ultimately an API call. Lesson: Management in the cloud

Archive tier

Offline access tier with the lowest storage cost for rarely used data kept at least 180 days; reads require rehydration. Lesson: Four access tiers

ARM templates

Declarative JSON files that describe Azure resources for Azure Resource Manager to deploy. Lesson: ARM templates and Bicep

Assume breach

Zero Trust principle: act as if attackers are already inside, so limit blast radius, segment and encrypt. Lesson: Zero Trust

Authentication

Proving who someone is, such as with a password, a phone approval or a fingerprint. Lesson: Authentication vs authorization

Authorization

Deciding what an authenticated person or app is allowed to do. Lesson: Authentication vs authorization

Availability sets

A way to spread VMs across fault domains and update domains so one failure or update doesn't stop them all. Lesson: Availability sets

Availability zones

Physically separate datacenters within an Azure region, each with independent power, cooling and networking. Lesson: Availability zones

AZ-900

Microsoft Azure Fundamentals exam: 45 minutes, scored 1-1,000 with 700 to pass, covering cloud concepts, Azure services and management. Lesson: The exam at a glance

AzCopy

Command-line utility for copying blobs or files to, from or between storage accounts, with one-way sync. Lesson: AzCopy

Azure Advisor

Service that reviews your Azure resources and recommends improvements for reliability, security, performance, operational excellence and cost. Lesson: Azure Advisor

Azure App Service

PaaS service for hosting web apps, API apps, WebJobs and mobile back ends without managing servers. Lesson: Platform as a service (PaaS)

Azure Arc

Service that extends Azure management, governance and monitoring to servers, Kubernetes clusters and data services outside Azure. Lesson: Hybrid cloud and multicloud

Azure Blob Storage

Object storage for huge amounts of unstructured data, such as images, video, backups and logs, reached by URL. Lesson: Five services, five jobs

Azure CLI

Cross-platform command-line tool for managing Azure with az commands. Lesson: Azure CLI and Azure PowerShell

Azure Cloud Shell

Browser-based, already signed-in shell with Bash or PowerShell and Azure tools preinstalled. Lesson: Azure Cloud Shell

Azure Container Apps

PaaS service for running containerized apps with built-in load balancing and scaling, without managing Kubernetes. Lesson: Containers

Azure Container Instances

PaaS service that runs a container in Azure without managing any VMs; the fastest, simplest way to run one. Lesson: Containers

Azure Data Box

Rugged, encrypted storage device shipped to you for moving large amounts of data into or out of Azure offline. Lesson: Azure Data Box

Azure Disk Storage

Managed block-level disks used as the drives of Azure virtual machines. Lesson: Five services, five jobs

Azure DNS

Hosting service for DNS domains on Azure's global name servers, managed with your other Azure resources. Lesson: Regions

Azure ExpressRoute

A private connection from your on-premises network to Microsoft's cloud through a connectivity provider, bypassing the internet. Lesson: Azure ExpressRoute

Azure File Sync

Service that keeps Windows file servers and an Azure Files share in two-way sync, with optional cloud tiering. Lesson: Azure File Sync

Azure Files

Fully managed cloud file shares that machines can mount with SMB or NFS, like a network drive. Lesson: Five services, five jobs

Azure Functions

Serverless compute service that runs small pieces of code in response to events, billed for the time the code runs. Lesson: Billed only while it runs

Azure Kubernetes Service (AKS)

Managed Kubernetes service for deploying, scaling and orchestrating many containers. Lesson: Containers

Azure Marketplace

Online store for third-party apps and services that run on Azure, billed through your Azure account. Lesson: Factors that affect costs

Azure Migrate

Hub for discovering, assessing and migrating on-premises servers, databases, web apps and desktops to Azure. Lesson: Azure Migrate

Azure Monitor

Platform that collects, analyzes and acts on metrics and logs from Azure, on-premises and other cloud resources. Lesson: One platform for metrics and logs

Azure Monitor alerts

Rules that notify you or start automation when monitoring data meets a condition. Lesson: Azure Monitor alerts

Azure Policy

Service that creates and assigns rules for Azure resources and evaluates compliance, denying, auditing or fixing what breaks them. Lesson: Rules for resources

Azure portal

Microsoft's web-based console for building, managing and monitoring Azure resources, with custom dashboards. Lesson: The Azure portal

Azure PowerShell

Set of PowerShell cmdlets (the Az module) for managing Azure from scripts or the command line. Lesson: Azure CLI and Azure PowerShell

Azure pricing calculator

Free web tool that estimates the monthly cost of Azure resources you plan to provision. Lesson: Predictability: performance and cost

Azure Queue Storage

Service that stores large numbers of messages, up to 64 KB each, so parts of an app can pass work along. Lesson: Five services, five jobs

Azure Reservations

A 1-year or 3-year commitment to specific Azure resources, such as VMs, in exchange for a large discount over pay-as-you-go prices. Lesson: Commit and save: reservations and savings plans

Azure Resource Manager (ARM)

Azure's deployment and management layer that authenticates and handles every request to create, change or delete resources. Lesson: Azure Resource Manager

Azure role-based access control (Azure RBAC)

Authorization system that grants who can do what to which Azure resources through role assignments. Lesson: Who, what, where

Azure Service Health

Service that reports Azure outages, planned maintenance and advisories, combining Azure status, Service Health and Resource Health. Lesson: Azure Service Health

Azure Spot Virtual Machines

VMs that use spare Azure capacity at a deep discount, but Azure can evict them when it needs the capacity back. Lesson: Spot pricing: cheap, but it can be taken back

Azure status

Public page showing the health of every Azure service in every region worldwide. Lesson: Azure Service Health

Azure storage account

Container for Azure Storage data objects (blobs, files, queues, tables) with a unique namespace reachable over HTTP or HTTPS. Lesson: The storage account

Azure Storage Explorer

Free graphical app for Windows, macOS and Linux for browsing and moving data in Azure Storage. Lesson: Azure Storage Explorer

Azure Table Storage

Service for structured NoSQL key-attribute data in schemaless tables. Lesson: Five services, five jobs

Azure Traffic Manager

DNS-based traffic load balancer that sends users to the best endpoint across Azure regions; a global, non-regional service. Lesson: Regions

Azure Virtual Desktop

Desktop and app virtualization service that delivers Windows desktops and apps from Azure to any device. Lesson: Azure Virtual Desktop

Azure virtual machine (VM)

An IaaS computer in Azure that you size, configure and manage, including its operating system. Lesson: Infrastructure as a service (IaaS)

Azure Virtual Machine Scale Sets

Groups of identical, load-balanced VMs that automatically increase or decrease in number with demand. Lesson: Virtual Machine Scale Sets

Azure Virtual Machines (VMs)

Azure's IaaS service for running virtual computers with full control of the operating system. Lesson: Virtual machines

Azure virtual network (VNet)

A private network in Azure that lets Azure resources talk to each other, the internet and on-premises networks. Lesson: Azure virtual networks

Azure VMware Solution

Azure service that runs VMware workloads on dedicated bare-metal hosts in Azure, so VMware environments move with little change. Lesson: Hybrid cloud and multicloud

Azure VPN Gateway

Virtual network gateway that sends encrypted traffic between a VNet and on-premises sites or devices over the internet. Lesson: Azure VPN Gateway

B

B2B collaboration

External ID feature that invites partners as guest users who sign in with their own credentials. Lesson: Partner and customer scenarios

B2B direct connect

Two-way trust with another Microsoft Entra organization, used for Teams shared channels, with no guest account created. Lesson: Partner and customer scenarios

Bicep

Simpler, Azure-native language for infrastructure as code that compiles into ARM templates. Lesson: ARM templates and Bicep

Billing

Reason to split subscriptions: keep, for example, production costs apart from development and testing costs. Lesson: Why add more subscriptions

Billing boundary

Subscription role in which Azure produces separate invoices and reports for each subscription. Lesson: Subscriptions

Blob containers

Folder-like groupings of blobs inside a storage account. Lesson: Blobs up close

Block blobs

The everyday blob type for text and binary files such as photos and documents. Lesson: Blobs up close

Border Gateway Protocol (BGP)

Routing protocol that exchanges routes between networks; ExpressRoute uses it for dynamic routing. Lesson: Azure ExpressRoute

Budget alerts

Notifications sent when spending reaches a set percentage of a Cost Management budget. Lesson: Three kinds of cost alerts

Budgets

Spending limits set for a scope in Cost Management that alert people when actual or forecast costs cross thresholds. Lesson: Microsoft Cost Management

C

CanNotDelete

Resource lock (shown as Delete) that allows reading and changing a resource but not deleting it. Lesson: Resource locks

Capital expenditure (CapEx)

Up-front spending on physical things like servers and buildings, whose cost is deducted over time. Lesson: CapEx vs OpEx

China East

Azure region in China operated by 21Vianet, separate from the global Azure cloud. Lesson: Sovereign regions

China North

Azure region in China operated by 21Vianet, separate from the global Azure cloud. Lesson: Sovereign regions

Cloud computing

Delivery of computing services such as servers, storage, databases, networking and software over the internet, paid for as you use them. Lesson: Someone else's computers, rented as you need them

Cloud security posture management (CSPM)

Continuous checking of cloud setups against security best practices, with a secure score and recommendations. Lesson: Posture and protection

Cloud tiering

Azure File Sync feature that keeps rarely used files only in Azure, leaving a pointer on the local server. Lesson: Azure File Sync

Cloud workload protection (CWP)

Defender plans that detect threats to servers, storage, databases, containers and more, and raise alerts. Lesson: Posture and protection

Cloud-based auditing

Automated checks that flag cloud resources that drift from your configuration baseline and suggest fixes. Lesson: Governance at scale

Cmdlets

PowerShell's verb-noun commands, such as New-AzVM. Lesson: Azure CLI and Azure PowerShell

Cold tier

Online access tier for rarely used data that still needs fast reads, kept at least 90 days. Lesson: Four access tiers

Command-line interface (CLI)

A text-based tool for managing resources by typing commands, which can be saved and repeated as scripts. Lesson: Management in the cloud

Conditional Access

Entra ID policy engine that uses sign-in signals to allow access, block it or require steps such as MFA. Lesson: If this, then that

Consumption-based model

Pricing where you pay only for the IT resources you actually use, with no up-front hardware cost. Lesson: Pay for what you use, nothing more

Containers

Lightweight, portable packages of an app and its dependencies that share the host operating system's kernel. Lesson: Containers

Contributor

Built-in Azure role that can create and manage all resources but can't grant access. Lesson: Built-in roles

Cool tier

Online access tier for infrequently used data kept at least 30 days: cheaper storage, higher access cost than hot. Lesson: Four access tiers

Cost analysis

Cost Management view that breaks spending down by subscription, resource group, service, region or tag. Lesson: Microsoft Cost Management

Cost predictability

Being able to forecast cloud spending by tracking usage, spotting trends and estimating with tools like the pricing calculator. Lesson: Predictability: performance and cost

Credit alerts

Notifications sent as Azure credit from an Enterprise Agreement commitment is being used up. Lesson: Three kinds of cost alerts

D

Data lineage

A record of where data came from, how it changed and where it went. Lesson: Microsoft Purview

Datacenters

Facilities full of servers in racks with dedicated power, cooling and networking; Azure groups them into regions and zones. Lesson: Datacenters

Decentralized design

Spreading resources across many regions worldwide so a disaster in one region doesn't take down the whole service. Lesson: Reliability

Declarative

Describing the end result you want rather than the steps to get there. Lesson: ARM templates and Bicep

Defense in depth

Security strategy that layers protections, from physical security to data, so one failure doesn't expose everything. Lesson: Defense in depth

Department spending quota alerts

Notifications sent when an Enterprise Agreement department reaches its fixed spending quota. Lesson: Three kinds of cost alerts

Development framework

PaaS feature that provides building blocks so developers can build scalable, highly available apps without managing servers. Lesson: When PaaS fits

Distributed denial of service (DDoS)

An attack that floods a service with traffic from many sources to make it unavailable. Lesson: Security: choose your level of control

Docker

Popular container engine for building and running containers; Azure supports Docker containers. Lesson: Containers

Durable Functions

Extension of Azure Functions for stateful workflows that remember earlier steps. Lesson: Functions

E

Early deletion charge

Fee for deleting or moving a blob before its tier's minimum days (cool 30, cold 90, archive 180) have passed. Lesson: Online and offline

East Asia

Azure region in Hong Kong, paired with Southeast Asia. Lesson: Region pairs

East US

Azure region in Virginia, paired with West US. Lesson: Region pairs

Egress

Data leaving an Azure region or datacenter; usually billed, while most incoming data is free. Lesson: Factors that affect costs

Environments

Reason to split subscriptions: separate sandbox, development, test and production. Lesson: Why add more subscriptions

Event-driven

Code that runs in response to an event, such as a web request, a timer or a new message, then stops. Lesson: Servers you never see

ExpressRoute failover

Using a site-to-site VPN as a backup path if an ExpressRoute connection fails. Lesson: VPN Gateway details

ExpressRoute Global Reach

ExpressRoute feature that connects your own on-premises sites to each other through Microsoft's network. Lesson: Azure ExpressRoute

External identities

People, devices or services outside your organization, such as partners, vendors and customers. Lesson: Who counts as external

F

Failover

Switching to a backup copy or location, such as making the secondary region the new primary after an outage. Lesson: Read access: RA-GRS and RA-GZRS

Fault domains

Groups of VMs that share power and network hardware; an availability set spreads VMs across them. Lesson: Availability sets

FIDO2 security keys

Passwordless sign-in keys (passkeys) built on the Fast Identity Online 2 standard, used over USB, NFC or Bluetooth. Lesson: Passwordless

G

Geo-redundant storage (GRS)

Redundancy option that keeps three copies in one datacenter (LRS) plus three more in a secondary region. Lesson: Copies in a second region

Geo-zone-redundant storage (GZRS)

Redundancy option that keeps three copies across zones (ZRS) plus three more in a secondary region. Lesson: Copies in a second region

Governance

Making sure deployed resources meet your organization's standards, policies and regulatory rules. Lesson: Governance at scale

Group Policy

Windows feature for centrally applying settings and security rules to domain-joined computers and users. Lesson: Microsoft Entra Domain Services

Guest users

External people added to your directory through B2B collaboration, with access you control. Lesson: Partner and customer scenarios

H

High availability

Keeping a service running with as little downtime as possible, even when parts of the system fail. Lesson: High availability and SLAs

Horizontal scaling

Changing the number of resources, such as adding VMs or containers (scaling out) or removing them (scaling in). Lesson: Scalability: up or out

Hot tier

Online access tier for frequently used data: highest storage cost, lowest access cost. Lesson: Four access tiers

Hybrid cloud

A setup that connects a public cloud and a private cloud or on-premises datacenter so workloads and data can move between them. Lesson: Hybrid cloud and multicloud

I

IaaS

Infrastructure as a service: you rent virtual machines, storage and networking and manage the operating system and apps yourself. Lesson: The dog-care ladder

Image

A template for creating VMs that already includes an operating system and often other software. Lesson: Virtual machines

Infrastructure as a service (IaaS)

Cloud service type where you rent virtual hardware (VMs, storage, networks) and manage the operating system and everything on it. Lesson: Security: choose your level of control

Infrastructure as code (IaC)

Managing infrastructure through code files that can be versioned, reviewed and deployed repeatably. Lesson: Infrastructure as code

Initiative

A group of related Azure Policy definitions assigned together as one set. Lesson: Initiatives, scope and remediation

K

Kusto Query Language (KQL)

Read-only query language used by Log Analytics to filter, summarize and chart log data. Lesson: Log Analytics

L

Least privilege

Giving people and apps only the access they need, only when they need it. Lesson: Zero Trust

Lifecycle management

Rule-based policies that automatically move blobs to cooler tiers or delete them as they age. Lesson: Let rules move the data

Lift-and-shift migration

Moving workloads to the cloud with little or no change, typically onto IaaS virtual machines. Lesson: When IaaS fits

Locally redundant storage (LRS)

Redundancy option that keeps three copies of data in one datacenter in the primary region. Lesson: Copies in the primary region

Log Analytics

Azure portal tool for writing and running KQL queries against log data collected by Azure Monitor. Lesson: Log Analytics

Log Analytics workspace

Storage location where Azure Monitor keeps log data for querying. Lesson: Log Analytics

Logs

Timestamped records of events, such as errors or sign-ins, queried in Log Analytics. Lesson: One platform for metrics and logs

M

Managed domain

A Windows domain whose domain controllers Microsoft deploys, patches and backs up for you. Lesson: Microsoft Entra Domain Services

Management groups

Containers above subscriptions that apply access and policies to many subscriptions at once. Lesson: Management groups

Metrics

Numeric values collected at regular intervals, such as CPU percentage, used for charts and fast alerts. Lesson: One platform for metrics and logs

Microservices

Architecture that splits an app into small, independent services that can be deployed and scaled separately. Lesson: Comparing the three

Microsoft 365

Microsoft's SaaS suite of productivity apps and services, including Exchange email, Teams, SharePoint and Office apps. Lesson: Software as a service (SaaS)

Microsoft Authenticator

Phone app for approving sign-ins, generating codes and passwordless sign-in. Lesson: Passwordless

Microsoft Azure

Microsoft's public cloud platform, offering hundreds of services for compute, storage, networking, data, AI, identity and management. Lesson: Someone else's computers, rented as you need them

Microsoft backbone network

Microsoft's private global network; traffic between peered VNets travels on it instead of the public internet. Lesson: Virtual network peering

Microsoft Cost Management

Azure tool for analyzing actual and forecast spending, setting budgets and getting cost alerts. Lesson: Microsoft Cost Management

Microsoft Defender for Cloud

Cloud-native application protection platform that assesses security posture and protects workloads in Azure, on premises and other clouds. Lesson: What it is

Microsoft Entra Connect

Tool that synchronizes users and groups from on-premises Active Directory to Microsoft Entra ID. Lesson: Hybrid identity

Microsoft Entra Domain Services

Managed domain service providing domain join, Group Policy, LDAP and Kerberos/NTLM without running domain controllers. Lesson: Microsoft Entra Domain Services

Microsoft Entra External ID

Entra capability for letting partners and customers sign in with their own identities, such as work or social accounts. Lesson: Who counts as external

Microsoft Entra ID

Microsoft's cloud-based identity and access management service, formerly Azure Active Directory. Lesson: Regions

Microsoft Entra multifactor authentication

Entra ID's MFA service, using methods such as Authenticator approvals, text or voice codes and hardware tokens. Lesson: Multifactor authentication

Microsoft Purview

Family of data governance, risk and compliance solutions for discovering, classifying and protecting data across your estate. Lesson: Microsoft Purview

Mobile apps

App Service hosting for the back end of iOS and Android apps, such as data storage and authentication. Lesson: Azure App Service

Multicloud

Using two or more public cloud providers at the same time, often managed together with tools like Azure Arc. Lesson: Hybrid cloud and multicloud

Multifactor authentication (MFA)

Sign-in that needs two or more different kinds of proof: something you know, have or are. Lesson: Multifactor authentication

N

Network security group (NSG)

A set of allow and deny rules that filter network traffic to and from Azure resources in a VNet. Lesson: Subnets, routing and filtering

Network-to-network

VPN connection that links one Azure VNet to another. Lesson: Azure VPN Gateway

Networking

VM requirement: a virtual network, public IP address and port configuration. Lesson: What a VM needs

Non-regional services

Azure services that are always available from Azure geographies and survive zone-wide and region-wide outages. Lesson: Using availability zones

O

Object storage

Storage that keeps data as objects reached by URL or API rather than as files on a mapped drive; Blob Storage is Azure's. Lesson: Files or Blob? The classic mix-up

Operating system

Software that runs a computer or VM, such as Windows or Linux; in IaaS, the customer installs and maintains it. Lesson: Infrastructure as a service (IaaS)

Operational expenditure (OpEx)

Ongoing spending on services or products as you use them, such as a monthly cloud bill; deducted in the same year. Lesson: CapEx vs OpEx

Owner

Built-in Azure role with full access to resources, including the right to grant access to others. Lesson: Built-in roles

P

PaaS

Platform as a service: the provider runs the hardware and operating system so you only build and run your app. Lesson: The dog-care ladder

Page blobs

Blobs for random read/write access, used for the virtual hard disk files behind VM disks. Lesson: Blobs up close

Passwordless authentication

Sign-in that replaces the password with a device plus a biometric or PIN. Lesson: Passwordless

Pay-as-you-go

Pricing model that bills for the resources you use each month, with no long-term commitment. Lesson: Pay-as-you-go

Performance predictability

Being able to forecast the resources needed for a good customer experience, supported by autoscaling, load balancing and high availability. Lesson: Predictability: performance and cost

Platform as a service (PaaS)

Cloud service type where the provider manages the hardware and operating system, and you manage your app and data. Lesson: Security: choose your level of control

Point-to-site

VPN connection that links a single device to an Azure VNet. Lesson: Azure VPN Gateway

Policy definitions

Individual Azure Policy rules describing a required condition and the effect, such as deny or audit. Lesson: Rules for resources

Policy-based

VPN gateway type that uses static IP address rules to decide which packets go through each tunnel. Lesson: VPN Gateway details

PowerShell

Microsoft's command shell and scripting language; the Az module adds cmdlets for managing Azure. Lesson: Management in the cloud

Predictability

Being able to plan cloud performance and cost with confidence before and while workloads run. Lesson: Predictability: performance and cost

Premium block blobs

Premium storage account type for block and append blobs needing high transaction rates or low latency. Lesson: The account types

Premium file shares

Premium storage account type for Azure Files only, supporting both SMB and NFS shares. Lesson: The account types

Premium page blobs

Premium storage account type for page blobs only. Lesson: The account types

Premium performance

Storage account performance level on solid-state drives, for consistently low latency and high transaction rates. Lesson: Standard or Premium

Primary region

The Azure region where a storage account's data is first written. Lesson: Copies in the primary region

Private cloud

Cloud-style computing used by a single organization, in its own datacenter or one hosted for it, with full control and full upkeep. Lesson: Private cloud

Private connection

A link that doesn't cross the public internet, such as an ExpressRoute circuit. Lesson: Azure ExpressRoute

Private DNS domains

Azure DNS zones that resolve custom names only inside your VNets. Lesson: Azure DNS

Private endpoint

A network interface with a private IP address from your VNet that connects privately to an Azure service. Lesson: Public and private endpoints

Public cloud

Cloud services run by a provider such as Microsoft and shared by many customers over the internet, with no hardware for you to buy. Lesson: Public cloud

Public endpoint

A service address with a public IP address that can be reached from anywhere on the internet. Lesson: Public and private endpoints

R

Read-access geo-redundant storage (RA-GRS)

GRS plus the ability to read the copies in the secondary region at any time. Lesson: Read access: RA-GRS and RA-GZRS

Read-access geo-zone-redundant storage (RA-GZRS)

GZRS plus the ability to read the copies in the secondary region at any time. Lesson: Read access: RA-GRS and RA-GZRS

Reader

Built-in Azure role that can view resources but not change them. Lesson: Built-in roles

ReadOnly

Resource lock that allows reading a resource but blocks changes and deletion. Lesson: Resource locks

Region

A geographical area containing one or more Azure datacenters linked by a low-latency network. Lesson: Regions

Rehydration

Moving an archived blob back to an online tier so it can be read, which can take up to 15 hours. Lesson: Online and offline

Reliability

The ability of a system to recover from failures and keep working. Lesson: Reliability

Remediation

Fixing existing non-compliant resources so they meet a policy, not just blocking new ones. Lesson: Initiatives, scope and remediation

Resource

A single manageable item in Azure, such as a VM, virtual network, storage account or database. Lesson: Resources

Resource group

A logical container for Azure resources that share a lifecycle; every resource belongs to exactly one resource group. Lesson: Resource groups

Resource groups

Logical containers that hold related Azure resources so they can be managed, secured and deleted together. Lesson: The hierarchy

Resource Health

Health status and history of an individual Azure resource, such as one VM. Lesson: Azure Service Health

Resource locks

Settings that block accidental deletion or change of Azure resources, even by Owners. Lesson: Resource locks

Resources

The building blocks you create in Azure, such as VMs, storage accounts and databases, each kept in a resource group. Lesson: The hierarchy

Role assignment

The link of a security principal, a role definition and a scope that grants access in Azure RBAC. Lesson: Who, what, where

Role definition

A named set of allowed actions, such as Reader or Contributor, used in role assignments. Lesson: Who, what, where

Route table

A set of routes that controls where traffic from a subnet goes next. Lesson: Subnets, routing and filtering

Route-based

VPN gateway type that uses IP routing to pick the tunnel; preferred, and needed for point-to-site connections. Lesson: VPN Gateway details

S

SaaS

Software as a service: a finished app delivered over the internet, such as email, that the provider fully runs. Lesson: The dog-care ladder

Scalability

The ability to adjust resources to meet demand, adding them when demand rises and removing them when it falls. Lesson: Scalability: up or out

Scope

Where a role assignment applies: a management group, subscription, resource group or resource. Lesson: Scope and inheritance

Secondary region

A second Azure region, usually the primary's pair, where geo-redundant storage keeps extra copies. Lesson: Copies in a second region

Secure score

Defender for Cloud's percentage measure of your security posture; following recommendations raises it. Lesson: Posture and protection

Security alerts

Defender for Cloud notifications about detected threats to your resources, with details and suggested steps. Lesson: Posture and protection

Security principal

The who in a role assignment: a user, group, service principal or managed identity. Lesson: Who, what, where

Self-service password reset (SSPR)

Entra ID feature that lets users reset their own passwords after verifying their identity. Lesson: What Entra ID does

Serverless

Cloud model where the provider runs and scales the servers, and you only supply code or configuration and pay when it runs. Lesson: Servers you never see

Service-level agreement (SLA)

A provider's formal commitment to a level of service, such as 99.9% uptime, often with service credits if it's missed. Lesson: High availability and SLAs

Shared responsibility model

The split of security and management duties between the cloud provider and the customer, which shifts with IaaS, PaaS or SaaS. Lesson: Shared responsibility

Signals

Facts Conditional Access weighs: user and groups, location, device and compliance, the app, and sign-in risk. Lesson: If this, then that

Single sign-on (SSO)

Signing in once with one identity to reach many apps. Lesson: Single sign-on

Site-to-site

VPN connection that links an on-premises network, such as an office or store, to an Azure VNet. Lesson: Azure VPN Gateway

Six levels

The maximum depth of a management group hierarchy, not counting the root level or the subscription level. Lesson: Management groups

Size

VM setting that sets its number of virtual CPUs and amount of memory, matched to its purpose. Lesson: What a VM needs

Software as a service (SaaS)

Cloud service type where you use a complete app run by the provider, managing only your data, users and settings. Lesson: Security: choose your level of control

Southeast Asia

Azure region in Singapore, paired with East Asia. Lesson: Region pairs

Sovereign regions

Instances of Azure isolated from the main public cloud for compliance or legal reasons, such as US government and China regions. Lesson: Sovereign regions

Standard general-purpose v2

The recommended storage account type for most scenarios, supporting blobs, files, queues, tables and every redundancy option. Lesson: The account types

Standard performance

Default storage account performance level: cost-effective storage for most data. Lesson: Standard or Premium

Stateless

Describes code that keeps no memory of earlier runs; Azure Functions are stateless by default. Lesson: Functions

Storage account endpoints

The web addresses for each storage service, made from the account name, such as name.blob.core.windows.net. Lesson: Names and endpoints

Storage disks

Managed disks (hard disk or solid-state drives) attached to a VM to hold its operating system and data. Lesson: What a VM needs

Subnet

A range of IP addresses inside a VNet used to group and isolate resources. Lesson: Subnets, routing and filtering

Subscription

A unit of management, billing and scale in Azure that holds resource groups and is linked to one Microsoft Entra tenant. Lesson: Subscriptions

Subscriptions

Containers for resource groups that act as billing and access-control boundaries in Azure. Lesson: The hierarchy

T

Tags

Name-value pairs attached to Azure resources, groups or subscriptions to organize them for cost, operations and automation. Lesson: Tags

Teams and workloads

Reason to split subscriptions: give each team or project its own, so costs are easy to track. Lesson: Why add more subscriptions

Templates

Predefined definitions of resources that make new deployments meet your technical standards and regulatory requirements. Lesson: Governance at scale

Tenant

An organization's dedicated instance of Microsoft Entra ID; every Azure subscription trusts one tenant. Lesson: Microsoft Entra ID

Tenant Root Group

The single top-level management group in each Microsoft Entra tenant; everything else nests under it. Lesson: Management groups

Testing and development

IaaS use case: quickly create, copy, start and stop test environments while keeping full control. Lesson: When IaaS fits

Total Cost of Ownership (TCO) calculator

Free web tool that compares the cost of running workloads on premises with running them in Azure. Lesson: Pricing calculator and TCO calculator

U

Update domains

Groups of VMs that can be rebooted together during planned maintenance; only one is updated at a time. Lesson: Availability sets

US DoD Central

Azure Government region reserved for workloads of the US Department of Defense. Lesson: Sovereign regions

US Gov Arizona

Azure Government region in Arizona for US government agencies and partners, isolated from the public Azure cloud. Lesson: Sovereign regions

US Gov Virginia

Azure Government region in Virginia for US government agencies and partners, isolated from the public Azure cloud. Lesson: Sovereign regions

User Access Administrator

Built-in Azure role that manages who has access to Azure resources, and nothing else. Lesson: Built-in roles

User-defined routes (UDRs)

Custom routes you add to a route table to override Azure's default routing. Lesson: Subnets, routing and filtering

V

Verify explicitly

Zero Trust principle: authenticate and authorize every request using all available signals. Lesson: Zero Trust

Vertical scaling

Changing the power of one resource, such as giving a VM more CPUs or memory (scaling up) or less (scaling down). Lesson: Scalability: up or out

Virtual network peering

A direct, private connection between two VNets, even in different regions, over Microsoft's network. Lesson: Virtual network peering

Virtual private network (VPN)

An encrypted tunnel that connects networks or devices securely over the public internet. Lesson: Azure VPN Gateway

VMs

Virtual machines: software computers running on shared hardware, each with its own operating system. Lesson: Three ways to host an app

W

Web apps

App Service hosting for websites and web applications in languages such as .NET, Java, Node.js, PHP and Python. Lesson: Azure App Service

Web portal

A graphical, browser-based way to manage cloud resources; in Azure, the Azure portal. Lesson: Management in the cloud

WebJobs

Programs or scripts that run alongside an App Service app, on a schedule or a trigger. Lesson: Azure App Service

West US

Azure region in California, paired with East US. Lesson: Region pairs

Windows Hello for Business

Passwordless sign-in with a face, fingerprint or PIN tied to the user's own Windows PC. Lesson: Passwordless

Z

Zero Trust

Security model that trusts no request by default and verifies each one, whatever network it comes from. Lesson: Zero Trust

Zonal services

Azure resources you pin to one specific availability zone, such as a VM, managed disk or IP address. Lesson: Using availability zones

Zone-redundant services

Azure services that the platform automatically replicates across availability zones, such as zone-redundant storage. Lesson: Using availability zones

Zone-redundant storage (ZRS)

Redundancy option that keeps three copies of data across three availability zones in the primary region. Lesson: Copies in the primary region

Acronyms

Microsoft, Azure, Intune and Windows are trademarks of the Microsoft group of companies. Ranger Gamez is not affiliated with or endorsed by Microsoft. The practice questions are written to the published exam objectives; they are not real exam questions.