Azure Solutions Architect Flashcards & Memory Notes

Metrics, logs, alerts, and insights for Azure and connected hybrid sources. Recommend diagnostic settings into Log Analytics when you need queries.

Metrics are near-real-time numeric series. Log queries in Log Analytics investigate conditions across resources over time.

Entra ID authenticates. RBAC authorizes actions on Azure resources at a scope.

Azure Key Vault, retrieved with managed identity when possible. Not only in App Configuration.

Subscriptions for governance and policy inheritance above the subscription boundary.

Whether a resource may exist or must have required properties, such as allowed regions or required tags.

Organize cost and ownership. They do not grant or deny permission.

When sign-in must meet conditions such as location, device, or risk before access is granted.

Contributor manages resources but cannot assign roles. Owner can manage resources and assign roles.

Centralized log retention, KQL investigation, and alerting across many resources and subscriptions.

Managed relational OLTP when you want PaaS features without a full SQL Server instance on a VM.

Near-full SQL Server compatibility with instance-scoped features, still as a managed service.

Document or multi-model NoSQL with global distribution and tunable consistency.

Blobs store objects by URL/API. Files provide SMB or NFS shared file access.

From access frequency and rehydration tolerance: hot, cool, cold, or archive.

Do not pay for multi-region writes or premium tiers the stem does not require.

Orchestrated extract, transform, and load across stores and compute.

Prefer PaaS unless the stem requires OS control or unsupported features.

Durable copies in a paired region. It is not a full application DR plan by itself.

Large-scale analytics on files with hierarchical namespace needs, not for every simple blob share.

How much data loss is acceptable, measured as time since the last recoverable point.

How long recovery may take before the service must be available again.

Backup restores point-in-time data. Site Recovery replicates for failover when RTO is short.

When the RTO is shorter than restore time from the vault for that workload.

Zones are separate datacenter failure domains. Sets spread VMs across fault and update domains in one non-zonal layout.

Coordinated failover of databases with a listener-style connection pattern for the app.

Copies data across zones in the region so a zonal outage is less likely to lose durability.

Azure Site Recovery to replicate on-premises machines into Azure for failover.

Higher availability and write locality against cost and consistency complexity.

Site Recovery for compute failover, Backup for point-in-time data recovery beyond the replica.

When you need full Kubernetes control, custom controllers, or cluster-level features Container Apps does not provide.

Revisions and event-driven scale without managing the Kubernetes control plane.

Event-driven or HTTP workloads that should scale without a long-lived server you manage.

Service Bus for durable queues and topics. Event Grid for filtered reactive event delivery.

High-throughput event streaming and ingestion at scale.

Key Vault for secrets. App Configuration for non-secret settings and feature flags.

Assess and plan migrations of machines, databases, and related workloads into Azure.

IaaS lifts with less change. PaaS refactors onto managed services when the app can accept it.

Private endpoint gives a private IP in your VNet. Service endpoint keeps the public service address and identifies your VNet.

VPN is IPsec over the internet. ExpressRoute is a private circuit for predictable hybrid connectivity.