AZ-900 Cheat Sheet: Azure Fundamentals Quick Reference

Print this. AZ-900 is vocabulary-dense — the exam tests whether you can match a scenario to the right service or concept name. This sheet organizes the material so the distinctions are scannable. For detailed answers with explanations, work through the AZ-900 question bank and mock exam.

Cloud models & economics

• Public cloud = provider-owned, internet-delivered, shared infrastructure
• Private cloud = dedicated to one organization (on-prem or hosted)
• Hybrid cloud = private + public integrated — the classic 'data on-prem, burst to cloud' pattern
• CapEx = upfront infrastructure purchase (on-prem); OpEx = pay-as-you-consume (cloud)
• Consumption model = pay only for what you use — the foundation of cloud economics
• Economies of scale = provider's volume purchasing lowers per-unit cost

Cloud benefit vocabulary (know the difference)

• High availability = uptime despite failures (SLA-driven: 99.9%, 99.95%)
• Scalability = ability to grow capacity
• Elasticity = automatic scaling up AND down with demand
• Agility = speed of provisioning (minutes, not procurement cycles)
• Vertical scaling (scale up) = bigger instance; horizontal (scale out) = more instances
• Geo-distribution = multiple regions for latency + disaster recovery

Service models

• IaaS = Azure VMs — you manage OS upward; most control, most responsibility
• PaaS = App Service, Functions — provider manages OS/runtime; you bring code
• SaaS = Microsoft 365, Dynamics 365 — finished software; least responsibility
• Shared responsibility: data, accounts, and identities are ALWAYS yours — in every model

Azure infrastructure hierarchy

• Region = geography of networked datacenters (choose for latency/compliance/features)
• Availability zone = physically separate datacenters within a region (zone = anti-datacenter-failure)
• Region pair = paired region in same geography for DR + sequential updates + data residency
• Management groups → subscriptions → resource groups → resources (governance hierarchy)
• Management group = policy/RBAC above subscriptions; resource group = lifecycle container, one per resource

Compute & networking

• VMs = IaaS full control | App Service = managed web apps | Functions = serverless per-execution
• Container Instances = run one container fast; AKS = orchestrate many (managed Kubernetes)
• VM Scale Sets = autoscaling identical VMs
• VNet = isolated network | VNet peering = connect two VNets
• VPN Gateway = encrypted over internet; ExpressRoute = private dedicated circuit (NOT internet)
• Load Balancer = L4 regional; Front Door = L7 global entry; CDN = cached content at edge

Storage

• Blob tiers: Hot (frequent) → Cool (≥30d infrequent) → Cold (≥90d rare) → Archive (cheapest, hours to rehydrate)
• LRS = 3 copies, one datacenter | ZRS = across zones, one region | GRS = + paired region | GZRS = both
• Azure Files = SMB/NFS file shares | Disk Storage = VM block storage | Data Lake = analytics-scale storage

Identity & security

• Microsoft Entra ID = the IdP (formerly Azure AD — old name still appears in docs)
• Authentication (AuthN) = who you are; Authorization (AuthZ) = what you can do
• MFA = ≥2 factor categories: know / have / are
• RBAC = role + principal + scope (management group/sub/RG/resource); inherits downward
• Zero Trust = verify explicitly + least privilege + assume breach
• Defense in depth = layered controls: physical → identity → perimeter → network → compute → app → data
• Defender for Cloud = secure score + posture + workload protection (CSPM + CWPP)

Cost & governance tools (heavily tested)

• Pricing Calculator = estimate BEFORE you build
• TCO Calculator = on-premises vs Azure comparison for migration business cases
• Cost Management = analyze actual spend, budgets, alerts
• Tags = metadata for cost reporting/organization (not enforcement)
• Azure Policy = enforce rules (allowed locations, SKUs, required tags); blocks non-compliant deployments
• Resource locks = CanNotDelete / ReadOnly — accidental-change protection, overrides permissions

Monitoring & deployment

• Azure Monitor = metrics + logs platform (Log Analytics, KQL, alerts)
• Application Insights = APM within Monitor
• Azure Advisor = recommendations for YOUR resources (cost/security/reliability/performance/op-ex)
• Service Health = personalized Azure platform issues/maintenance affecting you
• Deploy via: portal, Azure CLI, PowerShell, ARM templates (JSON), Bicep (compiles to ARM)