EXAM DAY REVISION

AZ-900
Cheat Sheet

Every decision rule, service pick, and exam trap on one page. Read it slowly once, then again fast just before your exam.

Ad728×90 Leaderboard

The responsibility ladder

On-premisesYou manage EVERYTHING

IaaS (VMs)Provider: hardware. You: OS ↑ (patching, runtime, apps, data)

PaaS (App Service)Provider: OS + platform. You: apps + data

SaaS (M365)Provider: everything. You: data, devices, identities

ALWAYS yoursData · Devices · Accounts & identities — in every model

Service picker — compute

Full OS control / legacy appVirtual Machines

Fleet of identical auto-scaling VMsVM Scale Sets

Deploy code, no serversApp Service

Event-triggered code, per-execution billingFunctions

One quick container, no orchestrationContainer Instances (ACI)

Many containers, orchestrationKubernetes Service (AKS)

Cloud Windows desktopsAzure Virtual Desktop

Service picker — network

Private isolated networkingVirtual Network (VNet)

Encrypted tunnel over internetVPN Gateway

Private circuit, never touches internetExpressRoute

VNet-to-VNet over MS backboneVNet peering

Secure RDP/SSH without public IPsBastion

Regional L4 traffic distributionLoad Balancer

L7 HTTP routing + WAF (regional)Application Gateway

Global HTTP entry + failoverFront Door

Cache static content near usersCDN

Storage decision rules

Unstructured objects (media, backups)Blob Storage

SMB network sharesAzure Files

Async messages between componentsQueue Storage

Hot / Cool / ArchiveFrequent / infrequent(30d+) / rarely-hours-to-restore

LRS → ZRS → GRSOne datacentre → zones in region → second region

Huge offline migrationData Box (physical shipment)

SLA + scaling maths

99.9% / 99.99%~8.8 hrs / ~52 min downtime per year

Composite SLAMULTIPLY: 99.9% × 99.9% ≈ 99.8% — always lower

Vertical scaling (up)Bigger machine — has a ceiling, only option for single-instance apps

Horizontal scaling (out)More machines — no ceiling, needs load balancing, cloud-preferred

ElasticityAUTOMATIC scaling with demand

Governance toolbox

WHO can do whatRBAC (least privilege: narrowest role + scope)

WHAT can exist / how configuredAzure Policy (deny blocks at deploy time)

Bundle of policiesInitiative

Prevent accidental delete/changeResource locks — apply to Owners too!

Cost attributionTags — NOT auto-inherited from resource groups

Scope hierarchyMgmt groups → Subscriptions → Resource groups → Resources

Cost & monitoring tools

Estimate planned Azure buildPricing Calculator

Compare vs on-premises costsTCO Calculator

Track actual spend + alertsCost Management (budgets ALERT, don't stop)

Free optimisation advice (5 pillars)Azure Advisor

Azure platform issues affecting YOUService Health

Your resource's health historyResource Health

Metrics + logs + alertsAzure Monitor (KQL in Log Analytics)

Up to 72% VM discount, 1-3yr commitReservations

Up to ~90% discount, evictableSpot VMs

Reuse Windows/SQL licencesAzure Hybrid Benefit

Top traps

Tags inherit from resource groups?NO — unless a policy copies them

Budgets stop resources at limit?NO — they only alert

Owner bypasses resource locks?NO — locks apply to everyone

OS shutdown stops VM billing?NO — must DEALLOCATE (portal Stop)

Every service in every region?NO — availability varies by region

MFA = two passwords?NO — different factor TYPES (know/have/are)

Zones protect against regional disaster?NO — that needs region pairs