Describe Azure Architecture and Services – AZ-900 Study Guide
This is the biggest domain (35–40% of the exam) and the most product-heavy. It covers how Azure is physically and logically organized, then the flagship services in compute, networking, storage, and identity/security. You don't need hands-on depth — you need to recognize each service's job and pick the right one for a one-paragraph scenario, especially when two similar services appear side by side (peering vs. VPN vs. ExpressRoute; LRS vs. ZRS vs. GRS; availability set vs. scale set).
Core Architectural Components
Physical layer — regions and zones:
- Region — a geographic area containing one or more datacenters. You pick a region for almost every resource; it determines latency, price, service availability, and data residency.
- Availability zone — a physically separate datacenter within a region, with independent power, cooling, and networking, connected to its siblings by high-speed private fiber. Deploying across zones survives a datacenter failure.
- Region pair — most regions are paired with another in the same geography (data residency preserved). Pairs get sequential platform updates and are the target for geo-redundant replication. Deploying across pairs survives a regional disaster.
- Sovereign regions — isolated instances of Azure for special compliance needs (e.g., US Government). Just recognize the term.
Resilience ladder (memorize the escalation): single VM → availability set (rack/host failure) → availability zones (datacenter failure) → region pair (regional disaster).
Logical layer — the resource hierarchy:
Management groups → Subscriptions → Resource groups → Resources
- Resource — any single service instance (a VM, a storage account).
- Resource group — a logical container for resources sharing a lifecycle; deleting the group deletes its contents. A resource lives in exactly one group; a group belongs to exactly one subscription.
- Subscription — a billing and access boundary. Organizations use multiple subscriptions to separate billing (dev vs. prod) or teams.
- Management group — groups subscriptions so policy and access can be applied once and inherited downward. Governance-at-scale questions ("apply a rule to 40 subscriptions at once") point here.
Compute Services
| Service | What it is | Scenario tell |
|---|---|---|
| Virtual Machines | IaaS servers — you manage the OS | "full control", "lift and shift", legacy apps |
| VM Scale Sets | Group of identical VMs that autoscales | "automatically add/remove identical VMs" |
| Availability sets | Spread VMs across fault/update domains in one datacenter | "protect against hardware failure and host maintenance" |
| Azure App Service | PaaS hosting for web apps and APIs | "deploy web app without managing servers" |
| Azure Functions | Serverless, event-driven code, per-execution billing | "run code when X happens", "pay only while running" |
| Containers (ACI / AKS) | ACI: run a container fast, no orchestration. AKS: managed Kubernetes for many containers | "lightweight, portable, fast startup"; AKS when "orchestration at scale" |
| Azure Virtual Desktop | Windows desktops/apps streamed from Azure to any device | "employees need Windows desktops on personal devices" |
Traps: containers share the host OS kernel (that's why they start faster than VMs). Scale sets change the number of VMs; availability sets protect a fixed set. Functions is the serverless answer; App Service still runs continuously.
Unlock with a paid plan
4 more sections (about 721 words) continue below. Every paid plan unlocks all AZ-900 study guides, the full question bank and mock exams, from $4.97/month.