Is Azure ExpressRoute traffic encrypted by default, and how do customers add encryption or backup connectivity?

ExpressRoute circuits are private dedicated connections, NOT encrypted by default. To encrypt traffic over ExpressRoute, customers can configure an IPsec VPN tunnel running inside ExpressRoute Private Peering, or use MACsec (Media Access Control security) on ExpressRoute Direct ports. A Site-to-Site VPN Gateway is commonly deployed in the same `GatewaySubnet` as an automatic encrypted failover path.

What is Azure Files and how does Azure File Sync extend it to on-premises Windows Servers?

Azure Files offers fully managed cloud file shares accessible via SMB (2.1/3.0/3.1.1 over TCP 445, or SMB over QUIC on UDP 443) and NFS (v4.1). Azure File Sync caches Azure File shares on on-premises Windows Servers, enabling multi-site sync and 'Cloud Tiering' (keeping only frequently accessed hot files cached locally while tiering cold files to the cloud as reparse pointers).

Compare Azure Functions Consumption Plan, Flex Consumption / Premium Plan, and Dedicated (App Service) Plan.

Consumption Plan: Serverless pay-per-execution, scales to zero, experiences cold starts, max execution timeout of 10 minutes, limited VNet integration. Premium Plan: Pre-warmed instances (no cold starts), VNet connectivity, unlimited execution duration (60+ min), higher cost. Dedicated (App Service) Plan: Runs on already-allocated App Service Plan VMs at no extra execution cost, supports `Always On`.

What are the three types of blobs in Azure Blob Storage and their use cases?

1. Block Blobs: Composed of blocks up to 4,000 MiB each (max ~190.7 TiB total); ideal for general files, images, videos, and documents. 2. Append Blobs: Optimized exclusively for append operations (cannot update or delete existing blocks); ideal for logging and audit trails. 3. Page Blobs: Collection of 512-byte pages up to 8 TB optimized for random read/write operations; backs Azure VM unmanaged/managed VHD disks.

What is the difference between a Basic Load Balancer and a Standard Load Balancer in Azure?

Standard Load Balancer (recommended; Basic is retiring) supports up to 1,000 backend instances, Availability Zones (zone-redundant/zonal frontends), HA Ports for NVAs, SLA of 99.99%, is secure by default (requires an explicit NSG rule to allow inbound traffic), and requires Standard SKU Public IPs.

What are the five main Azure Managed Disk performance tiers and their primary use cases?

1. Standard HDD: Backup, non-critical, infrequent access; 2. Standard SSD: Web servers, lightly used enterprise apps, dev/test; 3. Premium SSD: Production and performance-sensitive workloads (supports host caching); 4. Premium SSD v2: Sub-millisecond latency with decoupled capacity, IOPS, and throughput adjustment; 5. Ultra Disk: Highest IOPS/throughput for SAP HANA, top-tier SQL/Oracle databases.

What are Deployment Slots in Azure App Service and how does a Slot Swap work without downtime?

Deployment Slots (available in Standard, Premium, and Isolated tiers) are live apps with their own hostnames and configurations. During a swap (e.g., Staging to Production), Azure warms up the source slot, applies destination-specific 'Slot Settings' (connection strings/variables marked sticky to the slot), and seamlessly redirects the internal routing pointer from Staging to Production with zero dropped connections.

What causes an Azure DNS resolution order change inside a VNet, and what is the magic Azure IP `168.63.129.16`?

`168.63.129.16` is a virtual public IP address owned by Microsoft that exists inside every VNet to provide access to Azure platform services: the Azure-provided recursive DNS resolver, DHCP, VM Agent Guest health heartbeats, and Load Balancer health probes. It does not route over the internet and must never be blocked in outbound NSG rules if using Azure DNS or Load Balancers.

What is a Stored Access Policy on an Azure Storage container/queue/table/share and why use it with a Service SAS?

An ad-hoc SAS token encodes its start time, expiry time, and permissions directly in the URL; the only way to revoke it early is to rotate the entire Storage Account key (breaking all apps using that key). Associating a SAS with a Stored Access Policy allows you to modify permissions, change the expiration, or delete the policy on the server side to immediately revoke only that SAS.

What is Immutable Storage for Azure Blob Storage (WORM) and what are its two policy types?

Write Once, Read Many (WORM) storage prevents blobs from being modified or deleted for a specified interval (helping meet SEC 17a-4, FINRA, and CFTC compliance). The two policy types are: 1. Time-based retention policies (blobs cannot be modified/deleted until the retention period expires), and 2. Legal holds (blobs remain immutable until the legal hold is explicitly cleared).

Compare Azure Availability Sets and Availability Zones for Virtual Machine high availability and SLA.

Availability Set: Protects against hardware failures within a SINGLE datacenter using Fault Domains (up to 3, separate power/network racks) and Update Domains (up to 20, rebooted one at a time during maintenance); provides a 99.95% SLA for 2+ VMs. Availability Zones: Physically separate datacenters within an Azure Region with independent power, cooling, and networking; provides a 99.99% SLA for 2+ VMs across zones.

What is the difference between the 'Stopped' and 'Stopped (Deallocated)' states of an Azure Virtual Machine?

'Stopped': Shut down from inside the Guest OS; the VM still reserves its physical compute hardware and dynamic IPs on the Azure host, so you CONTINUE paying for compute hours. 'Stopped (Deallocated)': Stopped via Azure Portal/CLI/API (`az vm deallocate`); compute hardware is released and you stop paying for compute (only paying for attached Managed Disks and reserved Static Public IPs).

What are the five IP addresses reserved by Azure in every VNet subnet?

1. `.0`: Network address; 2. `.1`: Reserved by Azure for the default gateway; 3. `.2` and 4. `.3`: Reserved by Azure to map the Azure DNS IPs (`168.63.129.16`) to the VNet space; 5. `.255` (last address in CIDR): Network broadcast address. Thus, usable IPs per Azure subnet = $2^{(32 - \text{prefix})} - 5$.

What is Azure Virtual Network NAT (NAT Gateway) and what problem does it solve?

Azure NAT Gateway provides outbound-only internet connectivity for one or more subnets in a VNet. It solves SNAT port exhaustion by dynamically pooling up to 64,512 SNAT ports per attached Public IP address (supporting up to 16 Public IPs or a `/28` Public IP Prefix) and guarantees a predictable static outbound source IP.

What is the difference between GRS/GZRS and RA-GRS/RA-GZRS in Azure Storage?

With standard GRS or GZRS, the secondary region's data is NOT readable unless Microsoft initiates a regional failover or the customer manually initiates an account failover. With Read-Access (RA-GRS / RA-GZRS), the secondary region exposes a separate `-secondary` endpoint (e.g., `account-secondary.blob.core.windows.net`) that applications can read from at any time.

Compare VNet Service Endpoints and Azure Private Link (Private Endpoints) for securing access to Azure PaaS services like Azure Storage or SQL.

Service Endpoints keep traffic on the Azure backbone and extend your VNet identity to the PaaS firewall, but the PaaS resource still uses its public IP address (not reachable from on-prem without NAT). Private Endpoints assign a private IP address from your VNet subnet (`Microsoft.Network/privateEndpoints`) to a specific PaaS resource instance via Private DNS Zones, completely eliminating public internet exposure and working natively over VPN/ExpressRoute.

What are the three types of Shared Access Signatures (SAS) in Azure Storage and which is most secure?

1. User Delegation SAS: Signed with Microsoft Entra ID credentials (no storage account key used; works for Blob and Data Lake Gen2)—MOST SECURE recommended option. 2. Service SAS: Signed with the storage account key, scoped to a single storage service (Blob, Queue, Table, or File). 3. Account SAS: Signed with the storage account key, scoped across one or more services and allowing service-level operations.

How do you read a blob stored in the Azure Archive tier?

Because the Archive tier is offline, you cannot read or download an archived blob directly. You must either: 1. Change the blob's tier to Hot or Cool (Rehydrate), or 2. Copy the archived blob (`Copy Blob` API) to a new blob in the Hot or Cool tier within the same storage account. Rehydration priority can be set to Standard (up to 15 hours) or High (under 1 hour for blobs < 10 GB).

Compare AzCopy, Azure Storage Explorer, Azure Import/Export, and Azure Data Box for migrating data to Azure Storage.

AzCopy: High-performance command-line utility for scripted network transfers. Storage Explorer: GUI desktop app for browsing and uploading/downloading storage objects. Azure Import/Export: Customer ships their own BitLocker-encrypted SATA/SSD drives to an Azure datacenter. Azure Data Box (Disk / Data Box / Heavy): Microsoft ships ruggedized tamper-resistant storage appliances (8 TB to 1 PB) to the customer for offline bulk migration.

Compare Azure Load Balancer (Layer 4) and Azure Application Gateway (Layer 7).

Azure Load Balancer operates at OSI Layer 4 (TCP/UDP), routing traffic based on 5-tuple hash (source IP/port, dest IP/port, protocol) with ultra-low latency for any TCP/UDP service. Azure Application Gateway operates at OSI Layer 7 (HTTP/HTTPS/WebSocket), supporting SSL/TLS termination, cookie-based session affinity, URL path-based routing (`/images/*` vs `/video/*`), host-header multi-site routing, and integrated WAF.

Compare Azure VPN Gateway (Site-to-Site / Point-to-Site) and Azure ExpressRoute.

VPN Gateway sends encrypted IPsec/IKEv2 (Site-to-Site) or OpenVPN/SSTP/IKEv2 (Point-to-Site) traffic over the public internet (up to 10 Gbps aggregate in top SKUs). ExpressRoute establishes a private, dedicated connection between on-premises and Microsoft through a connectivity provider using BGP at Layer 3 (50 Mbps to 100 Gbps), bypassing the public internet for predictable latency and higher reliability.

What is the role of Azure Private DNS Zones when deploying Azure Private Endpoints?

When a client queries the public FQDN of a PaaS resource (e.g., `mystorage.blob.core.windows.net`), a linked Azure Private DNS Zone (`privatelink.blob.core.windows.net`) resolves the CNAME alias to the Private Endpoint's internal VNet IP address (e.g., `10.1.0.5`) rather than the public IP.

Compare Azure Storage redundancy options: LRS, ZRS, GRS, and GZRS.

LRS (Locally Redundant Storage): 3 synchronous copies within a single datacenter (11 nines durability). ZRS (Zone-Redundant Storage): 3 synchronous copies across 3 Availability Zones in the primary region (12 nines). GRS (Geo-Redundant Storage): LRS in primary region + asynchronous replication (LRS) to a paired secondary region (16 nines). GZRS (Geo-Zone-Redundant Storage): ZRS in primary region + asynchronous LRS in secondary region (16 nines).

When should you choose Azure Container Instances (ACI) vs. Azure Container Apps (ACA) vs. Azure Kubernetes Service (AKS)?

ACI: Simplest, fastest way to run a single isolated container or pod group on-demand (per-second billing, batch jobs, burst). ACA: Managed serverless container platform built on Kubernetes/KEDA/Dapr/Envoy for microservices and event-driven scale-to-zero without managing K8s APIs. AKS: Full managed Kubernetes cluster when you need custom CRDs, DaemonSets, CNI control, and deep orchestration.

What are Application Security Groups (ASGs) and Service Tags in Azure NSG rules?

ASGs allow you to group VM network interfaces logically by workload role (e.g., `WebServers`, `DbServers`) within the same VNet and reference the ASG in NSG rules instead of hardcoding IP addresses. Service Tags represent a Microsoft-managed group of IP address prefixes for a given Azure service (e.g., `Storage`, `Sql`, `Internet`, `VirtualNetwork`) that automatically updates as Azure IPs change.

Compare Uniform and Flexible orchestration modes in Azure Virtual Machine Scale Sets (VMSS).

Uniform orchestration: Uses identical VM instances managed from a single template; optimized for large-scale stateless workloads, does not support Availability Set fault domain guarantees beyond standard scale set placement. Flexible orchestration: Allows mixing different VM SKUs, combining Spot and Pay-As-You-Go instances, adding standard standalone VMs into the scale set, and provides high-availability guarantees up to 1,000 VMs.

What do the VNet Peering flags `UseGatewayTransit` and `UseRemoteGateways` do?

In a Hub-and-Spoke topology where the Hub VNet hosts a VPN Gateway or ExpressRoute Gateway: enable `AllowGatewayTransit` on the Hub VNet's peering link, and enable `UseRemoteGateways` on the Spoke VNet's peering link. This allows the Spoke VNet to share the Hub's gateway to reach on-premises networks without deploying its own gateway.

Compare the four Azure Blob Storage access tiers: Hot, Cool, Cold, and Archive.

Hot: Highest storage cost, lowest access/transaction cost; for frequently accessed data. Cool: Lower storage cost, higher access cost; minimum 30-day retention. Cold: Even lower storage cost, higher access cost; minimum 90-day retention (online millisecond latency). Archive: Lowest storage cost, highest retrieval cost; minimum 180-day retention, OFFLINE tier requiring rehydration (1 to 15 hours) before reading.

Compare Azure Front Door and Azure Traffic Manager for global load balancing.

Azure Front Door is a global Layer 7 HTTP/HTTPS reverse proxy and CDN sitting at Microsoft's edge POPs; it terminates SSL at the edge, uses split-TCP over Microsoft's global backbone, and includes global WAF. Azure Traffic Manager is a DNS-based global load balancer (Priority, Weighted, Performance, Geographic routing) that resolves domain names to endpoint IPs without proxying the actual packet traffic.

How does Azure Bastion work and why does it improve VM security?

Azure Bastion is a fully managed PaaS jump-box deployed into a dedicated subnet named `AzureBastionSubnet` (`/26` or larger). It allows administrators to connect to VMs via RDP or SSH directly inside the Azure Portal over TLS (port 443) without exposing Public IPs or opening ports 22/3389 to the internet on the target VMs.

Is Azure VNet Peering transitive by default, and how can two indirectly peered Spoke VNets communicate through a Hub VNet?

No, VNet Peering is non-transitive by default (if VNet A peers with Hub VNet B, and Hub VNet B peers with VNet C, A cannot talk directly to C). To enable Spoke-to-Spoke traffic through the Hub, configure a Network Virtual Appliance (NVA) or Azure Firewall in the Hub VNet, enable 'Allow forwarded traffic' on the peerings, and attach User-Defined Routes (UDRs) on the Spokes pointing to the Hub NVA/Firewall.

How do Azure Network Security Groups (NSGs) evaluate rules when an NSG is attached to both a Subnet and a VM's Network Interface (NIC)?

NSGs are stateful Layer 4 firewalls evaluated by priority (lowest number 100–4096 wins first). For Inbound traffic: Subnet NSG is evaluated first, then NIC NSG. For Outbound traffic: NIC NSG is evaluated first, then Subnet NSG. Traffic must be allowed by BOTH NSGs to pass.

Azure Compute, Networking (VNet, NSG, Application Gateway) & Storage

Essential Azure infrastructure services for AZ-900, AZ-104, and AZ-305 covering Virtual Machines, Availability Sets vs Availability Zones, VM Scale Sets, App Services, Azure Functions, AKS, Virtual Networks (VNet Peering, NSGs, ASGs, Firewall, Application Gateway, Load Balancer, ExpressRoute/VPN), and Storage Accounts.

Level: basic
Languages: en → en
Cards: 32
Markdown: Azure Compute, Networking (VNet, NSG, Application Gateway) & Storage (.md)

Flashcards (32)

#	Front (Term / Question)	Back (Definition / Answer)
1	Is Azure ExpressRoute traffic encrypted by default, and how do customers add encryption or backup connectivity?	ExpressRoute circuits are private dedicated connections, NOT encrypted by default. To encrypt traffic over ExpressRoute, customers can configure an IPsec VPN tunnel running inside ExpressRoute Private Peering, or use MACsec (Media Access Control security) on ExpressRoute Direct ports. A Site-to-Site VPN Gateway is commonly deployed in the same `GatewaySubnet` as an automatic encrypted failover path.
2	What is Azure Files and how does Azure File Sync extend it to on-premises Windows Servers?	Azure Files offers fully managed cloud file shares accessible via SMB (2.1/3.0/3.1.1 over TCP 445, or SMB over QUIC on UDP 443) and NFS (v4.1). Azure File Sync caches Azure File shares on on-premises Windows Servers, enabling multi-site sync and 'Cloud Tiering' (keeping only frequently accessed hot files cached locally while tiering cold files to the cloud as reparse pointers).
3	Compare Azure Functions Consumption Plan, Flex Consumption / Premium Plan, and Dedicated (App Service) Plan.	Consumption Plan: Serverless pay-per-execution, scales to zero, experiences cold starts, max execution timeout of 10 minutes, limited VNet integration. Premium Plan: Pre-warmed instances (no cold starts), VNet connectivity, unlimited execution duration (60+ min), higher cost. Dedicated (App Service) Plan: Runs on already-allocated App Service Plan VMs at no extra execution cost, supports `Always On`.
4	What are the three types of blobs in Azure Blob Storage and their use cases?	1. Block Blobs: Composed of blocks up to 4,000 MiB each (max ~190.7 TiB total); ideal for general files, images, videos, and documents. 2. Append Blobs: Optimized exclusively for append operations (cannot update or delete existing blocks); ideal for logging and audit trails. 3. Page Blobs: Collection of 512-byte pages up to 8 TB optimized for random read/write operations; backs Azure VM unmanaged/managed VHD disks.
5	What is the difference between a Basic Load Balancer and a Standard Load Balancer in Azure?	Standard Load Balancer (recommended; Basic is retiring) supports up to 1,000 backend instances, Availability Zones (zone-redundant/zonal frontends), HA Ports for NVAs, SLA of 99.99%, is secure by default (requires an explicit NSG rule to allow inbound traffic), and requires Standard SKU Public IPs.
6	What are the five main Azure Managed Disk performance tiers and their primary use cases?	1. Standard HDD: Backup, non-critical, infrequent access; 2. Standard SSD: Web servers, lightly used enterprise apps, dev/test; 3. Premium SSD: Production and performance-sensitive workloads (supports host caching); 4. Premium SSD v2: Sub-millisecond latency with decoupled capacity, IOPS, and throughput adjustment; 5. Ultra Disk: Highest IOPS/throughput for SAP HANA, top-tier SQL/Oracle databases.
7	What are Deployment Slots in Azure App Service and how does a Slot Swap work without downtime?	Deployment Slots (available in Standard, Premium, and Isolated tiers) are live apps with their own hostnames and configurations. During a swap (e.g., Staging to Production), Azure warms up the source slot, applies destination-specific 'Slot Settings' (connection strings/variables marked sticky to the slot), and seamlessly redirects the internal routing pointer from Staging to Production with zero dropped connections.
8	What causes an Azure DNS resolution order change inside a VNet, and what is the magic Azure IP `168.63.129.16`?	`168.63.129.16` is a virtual public IP address owned by Microsoft that exists inside every VNet to provide access to Azure platform services: the Azure-provided recursive DNS resolver, DHCP, VM Agent Guest health heartbeats, and Load Balancer health probes. It does not route over the internet and must never be blocked in outbound NSG rules if using Azure DNS or Load Balancers.
9	What is a Stored Access Policy on an Azure Storage container/queue/table/share and why use it with a Service SAS?	An ad-hoc SAS token encodes its start time, expiry time, and permissions directly in the URL; the only way to revoke it early is to rotate the entire Storage Account key (breaking all apps using that key). Associating a SAS with a Stored Access Policy allows you to modify permissions, change the expiration, or delete the policy on the server side to immediately revoke only that SAS.
10	What is Immutable Storage for Azure Blob Storage (WORM) and what are its two policy types?	Write Once, Read Many (WORM) storage prevents blobs from being modified or deleted for a specified interval (helping meet SEC 17a-4, FINRA, and CFTC compliance). The two policy types are: 1. Time-based retention policies (blobs cannot be modified/deleted until the retention period expires), and 2. Legal holds (blobs remain immutable until the legal hold is explicitly cleared).
11	Compare Azure Availability Sets and Availability Zones for Virtual Machine high availability and SLA.	Availability Set: Protects against hardware failures within a SINGLE datacenter using Fault Domains (up to 3, separate power/network racks) and Update Domains (up to 20, rebooted one at a time during maintenance); provides a 99.95% SLA for 2+ VMs. Availability Zones: Physically separate datacenters within an Azure Region with independent power, cooling, and networking; provides a 99.99% SLA for 2+ VMs across zones.
12	What is the difference between the 'Stopped' and 'Stopped (Deallocated)' states of an Azure Virtual Machine?	'Stopped': Shut down from inside the Guest OS; the VM still reserves its physical compute hardware and dynamic IPs on the Azure host, so you CONTINUE paying for compute hours. 'Stopped (Deallocated)': Stopped via Azure Portal/CLI/API (`az vm deallocate`); compute hardware is released and you stop paying for compute (only paying for attached Managed Disks and reserved Static Public IPs).
13	What are the five IP addresses reserved by Azure in every VNet subnet?	1. `.0`: Network address; 2. `.1`: Reserved by Azure for the default gateway; 3. `.2` and 4. `.3`: Reserved by Azure to map the Azure DNS IPs (`168.63.129.16`) to the VNet space; 5. `.255` (last address in CIDR): Network broadcast address. Thus, usable IPs per Azure subnet = $2^{(32 - \text{prefix})} - 5$.
14	What is Azure Virtual Network NAT (NAT Gateway) and what problem does it solve?	Azure NAT Gateway provides outbound-only internet connectivity for one or more subnets in a VNet. It solves SNAT port exhaustion by dynamically pooling up to 64,512 SNAT ports per attached Public IP address (supporting up to 16 Public IPs or a `/28` Public IP Prefix) and guarantees a predictable static outbound source IP.
15	What is the difference between GRS/GZRS and RA-GRS/RA-GZRS in Azure Storage?	With standard GRS or GZRS, the secondary region's data is NOT readable unless Microsoft initiates a regional failover or the customer manually initiates an account failover. With Read-Access (RA-GRS / RA-GZRS), the secondary region exposes a separate `-secondary` endpoint (e.g., `account-secondary.blob.core.windows.net`) that applications can read from at any time.
16	Compare VNet Service Endpoints and Azure Private Link (Private Endpoints) for securing access to Azure PaaS services like Azure Storage or SQL.	Service Endpoints keep traffic on the Azure backbone and extend your VNet identity to the PaaS firewall, but the PaaS resource still uses its public IP address (not reachable from on-prem without NAT). Private Endpoints assign a private IP address from your VNet subnet (`Microsoft.Network/privateEndpoints`) to a specific PaaS resource instance via Private DNS Zones, completely eliminating public internet exposure and working natively over VPN/ExpressRoute.
17	What are the three types of Shared Access Signatures (SAS) in Azure Storage and which is most secure?	1. User Delegation SAS: Signed with Microsoft Entra ID credentials (no storage account key used; works for Blob and Data Lake Gen2)—MOST SECURE recommended option. 2. Service SAS: Signed with the storage account key, scoped to a single storage service (Blob, Queue, Table, or File). 3. Account SAS: Signed with the storage account key, scoped across one or more services and allowing service-level operations.
18	How do you read a blob stored in the Azure Archive tier?	Because the Archive tier is offline, you cannot read or download an archived blob directly. You must either: 1. Change the blob's tier to Hot or Cool (Rehydrate), or 2. Copy the archived blob (`Copy Blob` API) to a new blob in the Hot or Cool tier within the same storage account. Rehydration priority can be set to Standard (up to 15 hours) or High (under 1 hour for blobs < 10 GB).
19	Compare AzCopy, Azure Storage Explorer, Azure Import/Export, and Azure Data Box for migrating data to Azure Storage.	AzCopy: High-performance command-line utility for scripted network transfers. Storage Explorer: GUI desktop app for browsing and uploading/downloading storage objects. Azure Import/Export: Customer ships their own BitLocker-encrypted SATA/SSD drives to an Azure datacenter. Azure Data Box (Disk / Data Box / Heavy): Microsoft ships ruggedized tamper-resistant storage appliances (8 TB to 1 PB) to the customer for offline bulk migration.
20	Compare Azure Load Balancer (Layer 4) and Azure Application Gateway (Layer 7).	Azure Load Balancer operates at OSI Layer 4 (TCP/UDP), routing traffic based on 5-tuple hash (source IP/port, dest IP/port, protocol) with ultra-low latency for any TCP/UDP service. Azure Application Gateway operates at OSI Layer 7 (HTTP/HTTPS/WebSocket), supporting SSL/TLS termination, cookie-based session affinity, URL path-based routing (`/images/` vs `/video/`), host-header multi-site routing, and integrated WAF.
21	Compare Azure VPN Gateway (Site-to-Site / Point-to-Site) and Azure ExpressRoute.	VPN Gateway sends encrypted IPsec/IKEv2 (Site-to-Site) or OpenVPN/SSTP/IKEv2 (Point-to-Site) traffic over the public internet (up to 10 Gbps aggregate in top SKUs). ExpressRoute establishes a private, dedicated connection between on-premises and Microsoft through a connectivity provider using BGP at Layer 3 (50 Mbps to 100 Gbps), bypassing the public internet for predictable latency and higher reliability.
22	What is the role of Azure Private DNS Zones when deploying Azure Private Endpoints?	When a client queries the public FQDN of a PaaS resource (e.g., `mystorage.blob.core.windows.net`), a linked Azure Private DNS Zone (`privatelink.blob.core.windows.net`) resolves the CNAME alias to the Private Endpoint's internal VNet IP address (e.g., `10.1.0.5`) rather than the public IP.
23	Compare Azure Storage redundancy options: LRS, ZRS, GRS, and GZRS.	LRS (Locally Redundant Storage): 3 synchronous copies within a single datacenter (11 nines durability). ZRS (Zone-Redundant Storage): 3 synchronous copies across 3 Availability Zones in the primary region (12 nines). GRS (Geo-Redundant Storage): LRS in primary region + asynchronous replication (LRS) to a paired secondary region (16 nines). GZRS (Geo-Zone-Redundant Storage): ZRS in primary region + asynchronous LRS in secondary region (16 nines).
24	When should you choose Azure Container Instances (ACI) vs. Azure Container Apps (ACA) vs. Azure Kubernetes Service (AKS)?	ACI: Simplest, fastest way to run a single isolated container or pod group on-demand (per-second billing, batch jobs, burst). ACA: Managed serverless container platform built on Kubernetes/KEDA/Dapr/Envoy for microservices and event-driven scale-to-zero without managing K8s APIs. AKS: Full managed Kubernetes cluster when you need custom CRDs, DaemonSets, CNI control, and deep orchestration.
25	What are Application Security Groups (ASGs) and Service Tags in Azure NSG rules?	ASGs allow you to group VM network interfaces logically by workload role (e.g., `WebServers`, `DbServers`) within the same VNet and reference the ASG in NSG rules instead of hardcoding IP addresses. Service Tags represent a Microsoft-managed group of IP address prefixes for a given Azure service (e.g., `Storage`, `Sql`, `Internet`, `VirtualNetwork`) that automatically updates as Azure IPs change.
26	Compare Uniform and Flexible orchestration modes in Azure Virtual Machine Scale Sets (VMSS).	Uniform orchestration: Uses identical VM instances managed from a single template; optimized for large-scale stateless workloads, does not support Availability Set fault domain guarantees beyond standard scale set placement. Flexible orchestration: Allows mixing different VM SKUs, combining Spot and Pay-As-You-Go instances, adding standard standalone VMs into the scale set, and provides high-availability guarantees up to 1,000 VMs.
27	What do the VNet Peering flags `UseGatewayTransit` and `UseRemoteGateways` do?	In a Hub-and-Spoke topology where the Hub VNet hosts a VPN Gateway or ExpressRoute Gateway: enable `AllowGatewayTransit` on the Hub VNet's peering link, and enable `UseRemoteGateways` on the Spoke VNet's peering link. This allows the Spoke VNet to share the Hub's gateway to reach on-premises networks without deploying its own gateway.
28	Compare the four Azure Blob Storage access tiers: Hot, Cool, Cold, and Archive.	Hot: Highest storage cost, lowest access/transaction cost; for frequently accessed data. Cool: Lower storage cost, higher access cost; minimum 30-day retention. Cold: Even lower storage cost, higher access cost; minimum 90-day retention (online millisecond latency). Archive: Lowest storage cost, highest retrieval cost; minimum 180-day retention, OFFLINE tier requiring rehydration (1 to 15 hours) before reading.
29	Compare Azure Front Door and Azure Traffic Manager for global load balancing.	Azure Front Door is a global Layer 7 HTTP/HTTPS reverse proxy and CDN sitting at Microsoft's edge POPs; it terminates SSL at the edge, uses split-TCP over Microsoft's global backbone, and includes global WAF. Azure Traffic Manager is a DNS-based global load balancer (Priority, Weighted, Performance, Geographic routing) that resolves domain names to endpoint IPs without proxying the actual packet traffic.
30	How does Azure Bastion work and why does it improve VM security?	Azure Bastion is a fully managed PaaS jump-box deployed into a dedicated subnet named `AzureBastionSubnet` (`/26` or larger). It allows administrators to connect to VMs via RDP or SSH directly inside the Azure Portal over TLS (port 443) without exposing Public IPs or opening ports 22/3389 to the internet on the target VMs.
31	Is Azure VNet Peering transitive by default, and how can two indirectly peered Spoke VNets communicate through a Hub VNet?	No, VNet Peering is non-transitive by default (if VNet A peers with Hub VNet B, and Hub VNet B peers with VNet C, A cannot talk directly to C). To enable Spoke-to-Spoke traffic through the Hub, configure a Network Virtual Appliance (NVA) or Azure Firewall in the Hub VNet, enable 'Allow forwarded traffic' on the peerings, and attach User-Defined Routes (UDRs) on the Spokes pointing to the Hub NVA/Firewall.
32	How do Azure Network Security Groups (NSGs) evaluate rules when an NSG is attached to both a Subnet and a VM's Network Interface (NIC)?	NSGs are stateful Layer 4 firewalls evaluated by priority (lowest number 100–4096 wins first). For Inbound traffic: Subnet NSG is evaluated first, then NIC NSG. For Outbound traffic: NIC NSG is evaluated first, then Subnet NSG. Traffic must be allowed by BOTH NSGs to pass.